From nobody Sat Feb 7 21:53:03 2026 Received: from out-183.mta1.migadu.com (out-183.mta1.migadu.com [95.215.58.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F84A3451AE for ; Thu, 16 Oct 2025 14:59:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.183 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626742; cv=none; b=P+Ygbyqs7jivudSYcSIHd5Is7bxuGLNdUm5EF64H/Zg/d7R0ou3Doyl3bL+FsgSgewLl025OEHM1yS52Iypwwr/ngSkgB3L81xPBtK9rpxPfnyi6nSkJTJ9JLOGFEy9WOvyHWTP681rppFsaRP7NKh7BvkprFSxTJCJvq7u+ZgE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626742; c=relaxed/simple; bh=PjmQAumqVG200dBo41AFGYL3MBYNt+UtWyJdspmHbwQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tXNwDMz+8dCy/wg7GVXWWC/W46odmTL++tgvS1zzjVY5z/2QEsE8+d4gWQ7a01QR65eTPswfIGtFuEwJ66NdcUekFsvmkP9QwSQfg0dned3xyU5yBZUayTBOF/OUyXokNx0v4Uwg/fO//EMnxxk6BHg5jSk2Fz81BPt5YiiEBEU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=LVO/gtE0; arc=none smtp.client-ip=95.215.58.183 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="LVO/gtE0" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1760626738; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CDg6q4AF09gd/6Pogmiva+sx2W7UnqDx36lrBRWQ0zU=; b=LVO/gtE0lB85Sg2LUz3oIaXGWK1z4EMKpOw17P4RqyIo4PuWNoawV0XrLVUczffmS7b7YB +iB+FI7EVxf13hlmEUxE5nkzrRSwEa/1SMSJOr6xBSoHRZ+z84HcdLFiTfNFwFBKcP+rTW 7l3AlGwLNQQ31AchnIpQ7uhO8RIDpaA= From: Leon Hwang To: bpf@vger.kernel.org Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, memxor@gmail.com, linux-kernel@vger.kernel.org, kernel-patches-bot@fb.com, Leon Hwang Subject: [PATCH bpf 1/3] bpf: Fix possible memleak in [lru_,]percpu_hash map update Date: Thu, 16 Oct 2025 22:57:59 +0800 Message-ID: <20251016145801.47552-2-leon.hwang@linux.dev> In-Reply-To: <20251016145801.47552-1-leon.hwang@linux.dev> References: <20251016145801.47552-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" As [lru_,]percpu_hash maps support BPF_KPTR_{REF,PERCPU}, missing calls to 'bpf_obj_free_fields()' in 'pcpu_copy_value()' can leak memory referenced by BPF_KPTR_{REF,PERCPU} fields. Fix this by calling 'bpf_obj_free_fields()' after 'copy_map_value[,_long]()' in 'pcpu_copy_value()'. Fixes: 65334e64a493 ("bpf: Support kptrs in percpu hashmap and percpu LRU h= ashmap") Signed-off-by: Leon Hwang --- kernel/bpf/hashtab.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index c2fcd0cd51e51..26308adc9ccb3 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -950,12 +950,14 @@ static void pcpu_copy_value(struct bpf_htab *htab, vo= id __percpu *pptr, if (!onallcpus) { /* copy true value_size bytes */ copy_map_value(&htab->map, this_cpu_ptr(pptr), value); + bpf_obj_free_fields(htab->map.record, this_cpu_ptr(pptr)); } else { u32 size =3D round_up(htab->map.value_size, 8); int off =3D 0, cpu; =20 for_each_possible_cpu(cpu) { copy_map_value_long(&htab->map, per_cpu_ptr(pptr, cpu), value + off); + bpf_obj_free_fields(htab->map.record, per_cpu_ptr(pptr, cpu)); off +=3D size; } } --=20 2.51.0 From nobody Sat Feb 7 21:53:03 2026 Received: from out-179.mta1.migadu.com (out-179.mta1.migadu.com [95.215.58.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C27263451AA for ; Thu, 16 Oct 2025 14:59:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626748; cv=none; b=lPeT/MkWt7og/EghJoKUDgRvtZ8PUjfwXBTMlgynULW7PQrtpup7ipR4cm6Xo7QuHZy+Q9HV9u2qX2W+mkPQL2oob5c+A50bSTZX9dJys+YtiUWD78MAc9oUdxZSVFr6V89vZnNUjh8FDpLsoxp0Ikh/RxJU8u04tsj0kXsy19I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626748; c=relaxed/simple; bh=PneJOE+5GCYSbec2t+KA/fNgWOJ8risb7FcysszoFm8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LRXBAI0nYmECUUOEmq0pdfNMlgI4bd6Et6sxk0BZdMZmlZQ6jUDwaMUqFjOB02DFDYNjG0dOjpN4ZSy949FbQ1EcY9C1Q4Q8bbveuPYc4YKmzQZAcLWS1QWpPczbMZFAgJ7d9OR4+KcyKYzZzFc7GP1di1U8TriUrpKcDcJBFng= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=UA6xoxc+; arc=none smtp.client-ip=95.215.58.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="UA6xoxc+" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1760626744; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=fwHz9CW1U502JagQ/hh1ku1vzSqD4BJw+Md0Gzmq1Os=; b=UA6xoxc+91GeGnZ+Nja+24l36DO1adYaZ99rFECUslw/50K6U5wS3yVyywjawkVNNjhI9Q TQacrFxob6XKkHBjbobMY3xmJORv26rpYiUbFrAAnmxJuNazAar6oGbF4AfFrmMdgfsrLv Nian2FWrRxP1jV3wLql2jFCw5NaTs6I= From: Leon Hwang To: bpf@vger.kernel.org Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, memxor@gmail.com, linux-kernel@vger.kernel.org, kernel-patches-bot@fb.com, Leon Hwang Subject: [PATCH bpf 2/3] bpf: Fix possible memleak when updating hash maps with BPF_F_LOCK Date: Thu, 16 Oct 2025 22:58:00 +0800 Message-ID: <20251016145801.47552-3-leon.hwang@linux.dev> In-Reply-To: <20251016145801.47552-1-leon.hwang@linux.dev> References: <20251016145801.47552-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" When updating hash maps with BPF_F_LOCK, the special fields were not freed after being replaced. This could cause memory referenced by BPF_KPTR_{REF,PERCPU} fields to leak. Fix this by calling 'check_and_free_fields()' after 'copy_map_value_locked()' to properly release the old fields. Fixes: 14a324f6a67e ("bpf: Wire up freeing of referenced kptr") Signed-off-by: Leon Hwang --- kernel/bpf/hashtab.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c index 26308adc9ccb3..65009ea3e9379 100644 --- a/kernel/bpf/hashtab.c +++ b/kernel/bpf/hashtab.c @@ -1124,6 +1124,7 @@ static long htab_map_update_elem(struct bpf_map *map,= void *key, void *value, copy_map_value_locked(map, htab_elem_value(l_old, key_size), value, false); + check_and_free_fields(htab, l_old); return 0; } /* fall through, grab the bucket lock and lookup again. @@ -1152,6 +1153,7 @@ static long htab_map_update_elem(struct bpf_map *map,= void *key, void *value, copy_map_value_locked(map, htab_elem_value(l_old, key_size), value, false); + check_and_free_fields(htab, l_old); ret =3D 0; goto err; } --=20 2.51.0 From nobody Sat Feb 7 21:53:03 2026 Received: from out-174.mta1.migadu.com (out-174.mta1.migadu.com [95.215.58.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C58E73469EE for ; Thu, 16 Oct 2025 14:59:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.174 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626754; cv=none; b=T0XcmvYA9Qa/RGBRG/2qso0Rzhub9C05d+aAIj2Xcfirs933UF+l7/0ZswyUhwUenv7CWbvEvvp2Rsr/09Q0MT3OQDYIkEaS4+heJOwuSKmDsF+pbjUvMH+AC4JObEv8+vnEAEFV2qGvqnQZ0jYhgN6c1uYb15DvwyTawC1KzV8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760626754; c=relaxed/simple; bh=ifwca9t1FI0mZhA6m3XOD4QjIFQPi+wiT20RQvJdTxA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DjG0yrbiDG5VqbjVYgDyixM9eAPOWoCKYno+cOOCjhhTuaY9kOLa35WNvg3WZgv4sOBsGxeR9L3jM8nzXn7E3p/B6cWA0IJH8muDAsqMor33kafCTPzMrzoNTPnpbUdFT1Fj2deE3Yb8SeBZDArWbiJHbLLw2B1ScDsNQT/sbRs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=FqH/Ufhj; arc=none smtp.client-ip=95.215.58.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="FqH/Ufhj" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1760626751; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=cKCoDyLrQNMo0GUUrFtOSIsoXntBFB19+5Bb9S8gtlE=; b=FqH/UfhjxE2UZeGjnz+9+4zQ1b6CRzfMOC+vS4dq/f2aKo/ptlWzm60MvVEu39KXABlR1H lEvOR9D+PFfyIe+NIeBHNe4g7lRZ4jDwnY13A1aA/7A0cdzpkSaor6YvtnCO+VqzvjlO0u M3GSy9KiAVvQCE6zXkU/xob9X3jtxpg= From: Leon Hwang To: bpf@vger.kernel.org Cc: ast@kernel.org, andrii@kernel.org, daniel@iogearbox.net, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, memxor@gmail.com, linux-kernel@vger.kernel.org, kernel-patches-bot@fb.com, Leon Hwang Subject: [PATCH bpf 3/3] selftests/bpf: Add test to verify no memleak when updating hash maps Date: Thu, 16 Oct 2025 22:58:01 +0800 Message-ID: <20251016145801.47552-4-leon.hwang@linux.dev> In-Reply-To: <20251016145801.47552-1-leon.hwang@linux.dev> References: <20251016145801.47552-1-leon.hwang@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Add two tests to verify that updating hash maps does not leak memory when BPF_KPTR_REF objects are involved. The test performs the following steps: 1. Call update_elem() to insert an initial value. 2. Use bpf_refcount_acquire() to increment the refcount. 3. Store the node pointer in the map value. 4. Add the node to a linked list. 5. Probe-read the refcount and verify it is *2*. 6. Call update_elem() again to trigger refcount decrement. 7. Verify that the field has been reset. Signed-off-by: Leon Hwang --- .../bpf/prog_tests/refcounted_kptr.c | 93 ++++++++++++++++ .../selftests/bpf/progs/refcounted_kptr.c | 101 ++++++++++++++++++ 2 files changed, 194 insertions(+) diff --git a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c b/too= ls/testing/selftests/bpf/prog_tests/refcounted_kptr.c index d6bd5e16e6372..9dc9a425cc65d 100644 --- a/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c +++ b/tools/testing/selftests/bpf/prog_tests/refcounted_kptr.c @@ -44,3 +44,96 @@ void test_refcounted_kptr_wrong_owner(void) ASSERT_OK(opts.retval, "rbtree_wrong_owner_remove_fail_a2 retval"); refcounted_kptr__destroy(skel); } + +static void test_refcnt_leak(void *values, size_t values_sz, u64 flags, bo= ol lock_hash) +{ + struct refcounted_kptr *skel; + int ret, fd, key =3D 0; + struct bpf_map *map; + LIBBPF_OPTS(bpf_test_run_opts, opts, + .data_in =3D &pkt_v4, + .data_size_in =3D sizeof(pkt_v4), + .repeat =3D 1, + ); + + skel =3D refcounted_kptr__open_and_load(); + if (!ASSERT_OK_PTR(skel, "refcounted_kptr__open_and_load")) + return; + + map =3D skel->maps.pcpu_hash; + if (lock_hash) + map =3D skel->maps.lock_hash; + + ret =3D bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, f= lags); + if (!ASSERT_OK(ret, "bpf_map__update_elem first")) + goto out; + + fd =3D bpf_program__fd(skel->progs.pcpu_hash_refcount_leak); + if (lock_hash) + fd =3D bpf_program__fd(skel->progs.hash_lock_refcount_leak); + + ret =3D bpf_prog_test_run_opts(fd, &opts); + if (!ASSERT_OK(ret, "test_run_opts")) + goto out; + if (!ASSERT_EQ(opts.retval, 2, "retval refcount")) + goto out; + + ret =3D bpf_map__update_elem(map, &key, sizeof(key), values, values_sz, f= lags); + if (!ASSERT_OK(ret, "bpf_map__update_elem second")) + goto out; + + fd =3D bpf_program__fd(skel->progs.check_pcpu_hash_refcount); + if (lock_hash) + fd =3D bpf_program__fd(skel->progs.check_hash_lock_refcount); + + ret =3D bpf_prog_test_run_opts(fd, &opts); + if (!ASSERT_OK(ret, "test_run_opts")) + goto out; + if (!ASSERT_EQ(opts.retval, 1, "retval")) + goto out; + +out: + refcounted_kptr__destroy(skel); +} + +static void test_percpu_hash_refcount_leak(void) +{ + size_t values_sz; + u64 *values; + int cpu_nr; + + cpu_nr =3D libbpf_num_possible_cpus(); + if (!ASSERT_GT(cpu_nr, 0, "libbpf_num_possible_cpus")) + return; + + values =3D calloc(cpu_nr, sizeof(u64)); + if (!ASSERT_OK_PTR(values, "calloc values")) + return; + + values_sz =3D cpu_nr * sizeof(u64); + memset(values, 0, values_sz); + + test_refcnt_leak(values, values_sz, 0, false); + + free(values); +} + +struct hash_lock_value { + struct bpf_spin_lock lock; + u64 node; +}; + +static void test_hash_lock_refcount_leak(void) +{ + struct hash_lock_value value =3D {}; + + test_refcnt_leak(&value, sizeof(value), BPF_F_LOCK, true); +} + +void test_refcount_leak(void) +{ + if (test__start_subtest("percpu_hash_refcount_leak")) + test_percpu_hash_refcount_leak(); + if (test__start_subtest("hash_lock_refcount_leak")) + test_hash_lock_refcount_leak(); +} diff --git a/tools/testing/selftests/bpf/progs/refcounted_kptr.c b/tools/te= sting/selftests/bpf/progs/refcounted_kptr.c index 893a4fdb4b6e9..8c41fe53da9e3 100644 --- a/tools/testing/selftests/bpf/progs/refcounted_kptr.c +++ b/tools/testing/selftests/bpf/progs/refcounted_kptr.c @@ -568,4 +568,105 @@ int BPF_PROG(rbtree_sleepable_rcu_no_explicit_rcu_loc= k, return 0; } =20 +static int __insert_in_list(struct bpf_list_head *head, struct bpf_spin_lo= ck *lock, + struct node_data __kptr **node) +{ + struct node_data *n, *m; + u32 refcnt; + void *ref; + + n =3D bpf_obj_new(typeof(*n)); + if (!n) + return -1; + + m =3D bpf_refcount_acquire(n); + n =3D bpf_kptr_xchg(node, n); + if (n) { + bpf_obj_drop(n); + bpf_obj_drop(m); + return -2; + } + + bpf_spin_lock(lock); + bpf_list_push_front(head, &m->l); + ref =3D (void *) &m->ref; + bpf_spin_unlock(lock); + + bpf_probe_read_kernel(&refcnt, sizeof(refcnt), ref); + return refcnt; +} + +static void *__lookup_map(void *map) +{ + int key =3D 0; + + return bpf_map_lookup_elem(map, &key); +} + +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_HASH); + __type(key, int); + __type(value, struct map_value); + __uint(max_entries, 1); +} pcpu_hash SEC(".maps"); + +SEC("tc") +int pcpu_hash_refcount_leak(void *ctx) +{ + struct map_value *v; + + v =3D __lookup_map(&pcpu_hash); + if (!v) + return 0; + + return __insert_in_list(&head, &lock, &v->node); +} + +SEC("tc") +int check_pcpu_hash_refcount(void *ctx) +{ + struct map_value *v; + + v =3D __lookup_map(&pcpu_hash); + return v && v->node =3D=3D NULL; +} + +struct hash_lock_map_value { + struct node_data __kptr *node; + struct bpf_spin_lock lock; + int value; +}; + +struct { + __uint(type, BPF_MAP_TYPE_HASH); + __type(key, int); + __type(value, struct hash_lock_map_value); + __uint(max_entries, 1); +} lock_hash SEC(".maps"); + +SEC("tc") +int hash_lock_refcount_leak(void *ctx) +{ + struct hash_lock_map_value *v; + + v =3D __lookup_map(&lock_hash); + if (!v) + return 0; + + bpf_spin_lock(&v->lock); + v->value =3D 42; + bpf_spin_unlock(&v->lock); + + return __insert_in_list(&head, &lock, &v->node); +} + +SEC("tc") +int check_hash_lock_refcount(void *ctx) +{ + struct hash_lock_map_value *v; + + v =3D __lookup_map(&lock_hash); + return v && v->node =3D=3D NULL; +} + char _license[] SEC("license") =3D "GPL"; --=20 2.51.0