From nobody Fri Jul 24 22:56:49 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20ADB3469F6; Wed, 22 Jul 2026 11:23:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; cv=none; b=FAHo8yY3PWLoh6nYlgBk7SEqoeGs38cg+oHJD/5ieOXMC0AdKmQTZsAPA8E0LpKOPqBgRd8qj0r/QsLbQyox/g48Te5bE/kDvS2oODze+sIVJM1YeqJDlPJpI8KkkFl4ZxrJ0V0pssF74gAA/T9S+H9OXZP5teozqp7+Tdjod2A= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; c=relaxed/simple; bh=DryYS+Y60yP2j8JbOxCWg08we7PpKlyCu0P83LETtLE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=WbHDf6o7i58jKyXk0RLdW2Pm5OuYBtuIfb323dsjYBF7Gp5rU8r/Xyn1hofE+7s0IfbTC5TNRvEgjwOzpSqv1Plg/lkKQagGJ4K+IY34qhPp+5x/+a03XBdvjCEnrJJCgpBbrKuXcljaPM073WI3k7UzYZkpm1iCkYzFZfj4ziw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4h4sL86qVkzKHMb0; Wed, 22 Jul 2026 19:22:40 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id 86AA1405C7; Wed, 22 Jul 2026 19:23:24 +0800 (CST) Received: from ultra.huawei.com (unknown [10.90.53.71]) by APP4 (Coremail) with UTF8SMTPA id gCh0CgB3qVorqGBqllacCA--.32600S3; Wed, 22 Jul 2026 19:23:24 +0800 (CST) From: Pu Lehui To: bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Yonghong Song , Song Liu , Jiri Olsa , Emil Tsalapatis , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Puranjay Mohan , Xu Kuohai , Tiezhu Yang , Hengqi Chen , Pu Lehui , Pu Lehui Subject: [PATCH bpf-next 1/4] bpf, arm64: Fix memory leak in bpf_jit_free Date: Wed, 22 Jul 2026 11:27:51 +0000 Message-Id: <20260722112754.1615201-2-pulehui@huaweicloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722112754.1615201-1-pulehui@huaweicloud.com> References: <20260722112754.1615201-1-pulehui@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgB3qVorqGBqllacCA--.32600S3 X-Coremail-Antispam: 1UD129KBjvJXoW7tr1fXF18XryfWFWDAF4fZrb_yoW8Gr45pF yDuw13C3yqgF1vyF4DJa10vFW8Cws5tw1YkryUur4fKFnFgr92gF4Sk3y3uay5ArWUXw4r WrW5KrnxCFykJ3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUmvb4IE77IF4wAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k2 6cxKx2IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUGw A2048vs2IY020Ec7CjxVAFwI0_Gr0_Xr1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxS w2x7M28EF7xvwVC0I7IYx2IY67AKxVWUJVWUCwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxV W8JVWxJwA2z4x0Y4vEx4A2jsIE14v26F4UJVW0owA2z4x0Y4vEx4A2jsIEc7CjxVAFwI0_ GcCE3s1le2I262IYc4CY6c8Ij28IcVAaY2xG8wAqx4xG64xvF2IEw4CE5I8CrVC2j2WlYx 0E2Ix0cI8IcVAFwI0_Jr0_Jr4lYx0Ex4A2jsIE14v26r1j6r4UMcvjeVCFs4IE7xkEbVWU JVW8JwACjcxG0xvY0x0EwIxGrwACjI8F5VA0II8E6IAqYI8I648v4I1lFIxGxcIEc7CjxV A2Y2ka0xkIwI1lc7CjxVAaw2AFwI0_GFv_Wryl42xK82IYc2Ij64vIr41l4I8I3I0E4IkC 6x0Yz7v_Jr0_Gr1lx2IqxVAqx4xG67AKxVWUJVWUGwC20s026x8GjcxK67AKxVWUGVWUWw C2zVAF1VAY17CE14v26r4a6rW5MIIYrxkI7VAKI48JMIIF0xvE2Ix0cI8IcVAFwI0_Jr0_ JF4lIxAIcVC0I7IYx2IY6xkF7I0E14v26r4j6F4UMIIF0xvE42xK8VAvwI8IcIk0rVWUJV WUCwCI42IY6I8E87Iv67AKxVW8JVWxJwCI42IY6I8E87Iv6xkF7I0E14v26r4UJVWxJrUv cSsGvfC2KfnxnUUI43ZEXa7sRMv31JUUUUU== X-CM-SenderInfo: psxovxtxl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Pu Lehui When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive for the subsequent extra pass. If JIT compilation fails for a later subprogram, the BPF core aborts and calls bpf_jit_free() to clean up the first subprogram. However, bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory leak of the JIT context offsets array. Fix this by adding the missing kvfree(jit_data->ctx.offset) in bpf_jit_free(). Fixes: 1dad391daef1 ("bpf, arm64: use bpf_prog_pack for memory management") Reported-by: Sashiko Signed-off-by: Pu Lehui Acked-by: Xu Kuohai --- arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 4cdc7dfb05ba..f4e4d4578e38 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -3237,6 +3237,7 @@ void bpf_jit_free(struct bpf_prog *prog) */ if (jit_data) { bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kvfree(jit_data->ctx.offset); kfree(jit_data); } prog->bpf_func =3D (void *)prog->bpf_func - cfi_get_offset(); --=20 2.34.1 From nobody Fri Jul 24 22:56:49 2026 Received: from dggsgout12.his.huawei.com (dggsgout12.his.huawei.com [45.249.212.56]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 20B9D4C8FFA; Wed, 22 Jul 2026 11:23:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.56 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; cv=none; b=mlaO/q7uqwUK+ebGy9W2G+0Vllpa7s0TGg5ImfWGM2qXCfD15M6z4Y8SB+x1hiZBThDuZYymUpo5KYmiuZZcOgZR9w5GkfmYT4KYTtpmNKtz85QOPKfb42UvAqXGNusHlEYu48jbU/JWwaatZf+eI0tCMJ+mzqKqPj/kc3/dIb0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; c=relaxed/simple; bh=F5t63L7zHkjqEAJT2oL7YPfONiHIcWs/Pj2/jIjEnKc=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=TOmqLCRlUUAUvjHqcJm7NEAstr60m7Wr3esAY1ttA6ehLMFrTtCbSaxjB3MfmV+EcxOkHrzwkoXW8qPFR+L6DWq83fc3pnypegsKNb+uOfCtwczmDa1chaVY5IS5RBLmqgHc7Eb7SpWS0ezSsMBgRIq9bzYTF41IHbPX1y3/1wM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.56 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout12.his.huawei.com (SkyGuard) with ESMTPS id 4h4sL90446zKHMbH; Wed, 22 Jul 2026 19:22:41 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id 9356A40592; Wed, 22 Jul 2026 19:23:24 +0800 (CST) Received: from ultra.huawei.com (unknown [10.90.53.71]) by APP4 (Coremail) with UTF8SMTPA id gCh0CgB3qVorqGBqllacCA--.32600S4; Wed, 22 Jul 2026 19:23:24 +0800 (CST) From: Pu Lehui To: bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Yonghong Song , Song Liu , Jiri Olsa , Emil Tsalapatis , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Puranjay Mohan , Xu Kuohai , Tiezhu Yang , Hengqi Chen , Pu Lehui , Pu Lehui Subject: [PATCH bpf-next 2/4] LoongArch: BPF: Fix memory leak in bpf_jit_free Date: Wed, 22 Jul 2026 11:27:52 +0000 Message-Id: <20260722112754.1615201-3-pulehui@huaweicloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722112754.1615201-1-pulehui@huaweicloud.com> References: <20260722112754.1615201-1-pulehui@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgB3qVorqGBqllacCA--.32600S4 X-Coremail-Antispam: 1UD129KBjvJXoW7tr1fXF18XryDCFW5Jr1DKFg_yoW8JFWkpF yDuwn3C3yvgryxtF4DJw48WFW8Jws5Gw13Wa4Uur1xKF1agr10gFn2k3srWFZ8ArWUJ3yr WrWrGrnI9FykG3DanT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUmF14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_Jryl82xGYIkIc2 x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2z4x0 Y4vE2Ix0cI8IcVAFwI0_Jr0_JF4l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UM2 8EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq3wAS 0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2 IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0 Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2kIc2 xKxwCY1x0262kKe7AKxVW8ZVWrXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWU JVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67 kF1VAFwI0_GFv_WrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI42IY 6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42 IY6I8E87Iv67AKxVW8JVWxJwCI42IY6I8E87Iv6xkF7I0E14v26r4UJVWxJrUvcSsGvfC2 KfnxnUUI43ZEXa7sRipB-tUUUUU== X-CM-SenderInfo: psxovxtxl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Pu Lehui When bpf_int_jit_compile() is called for subprograms, it returns early during the first pass (!prog->is_func || extra_pass is false), keeping ctx->offset alive for the subsequent extra pass. If JIT compilation fails for a later subprogram, the BPF core aborts and calls bpf_jit_free() to clean up the first subprogram. However, bpf_jit_free() fails to free jit_data->ctx.offset, which causes a memory leak of the JIT context offsets array. Fix this by adding the missing kvfree(jit_data->ctx.offset) in bpf_jit_free(). Fixes: 4ab17e762b34 ("LoongArch: BPF: Use BPF prog pack allocator") Reported-by: Sashiko Signed-off-by: Pu Lehui Acked-by: Tiezhu Yang --- arch/loongarch/net/bpf_jit.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 2738b4db1165..3d3ed1677d01 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -2361,6 +2361,7 @@ void bpf_jit_free(struct bpf_prog *prog) */ if (jit_data) { bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->header); + kvfree(jit_data->ctx.offset); kfree(jit_data); } hdr =3D bpf_jit_binary_pack_hdr(prog); --=20 2.34.1 From nobody Fri Jul 24 22:56:49 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 387644C954F; Wed, 22 Jul 2026 11:23:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719410; cv=none; b=Lq400l/fcKAS7lYgeJAje2qRJYljJ+Lx2lXFsbtU9X5VZJZWVWWc+FRBhKaB5xBXwisMCnTfiOYLrzGBpl/jNuG39nx55TM5iOvDFRoe/vIP265wHVE/J+nm8qOiagdE1asixo0iqnZAYxk7ID44ye1Rp2nQq/1UYIwbBpufaG4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719410; c=relaxed/simple; bh=0xoPHCWDtlETgPlG53cBhcjI6ZaTGFJDXl4n5HFClbg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=pxonyjTTe7QiLe8dZUWOzAuHu/c8ksGR4BxtgzkrbM87AlsRxkC1owhQcPRNzkZr9DkullI87MdbnAxaVZpL8UVfD++JttrL8s8UeurpGB+wYcep1BVIUCn/HY/6gLIj7vgxxn3wFyHtisY88ypLyRdcQdqGzA+DQT73iDcl1Z4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.198]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4h4sLR5Bn1zYQtvC; Wed, 22 Jul 2026 19:22:55 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id A29E340577; Wed, 22 Jul 2026 19:23:24 +0800 (CST) Received: from ultra.huawei.com (unknown [10.90.53.71]) by APP4 (Coremail) with UTF8SMTPA id gCh0CgB3qVorqGBqllacCA--.32600S5; Wed, 22 Jul 2026 19:23:24 +0800 (CST) From: Pu Lehui To: bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Yonghong Song , Song Liu , Jiri Olsa , Emil Tsalapatis , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Puranjay Mohan , Xu Kuohai , Tiezhu Yang , Hengqi Chen , Pu Lehui , Pu Lehui Subject: [PATCH bpf-next 3/4] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free Date: Wed, 22 Jul 2026 11:27:53 +0000 Message-Id: <20260722112754.1615201-4-pulehui@huaweicloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722112754.1615201-1-pulehui@huaweicloud.com> References: <20260722112754.1615201-1-pulehui@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgB3qVorqGBqllacCA--.32600S5 X-Coremail-Antispam: 1UD129KBjvdXoWrtF47Zr17Gw1UWF1UWF45Jrb_yoWkZrb_C3 48JFWIqw4rJa18Cw4Ygrs5Wr4UKw4rtF4rXr1SqrWkAasYvwsIyas2qrn5u3yxur1jyFZ3 WF95JFyIvw4aqjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT 9fnUUIcSsGvfJTRUUUbkAFF20E14v26rWj6s0DM7CY07I20VC2zVCF04k26cxKx2IYs7xG 6rWj6s0DM7CIcVAFz4kK6r1j6r18M28IrcIa0xkI8VA2jI8067AKxVWUWwA2048vs2IY02 0Ec7CjxVAFwI0_Xr0E3s1l8cAvFVAK0II2c7xJM28CjxkF64kEwVA0rcxSw2x7M28EF7xv wVC0I7IYx2IY67AKxVWUJVWUCwA2z4x0Y4vE2Ix0cI8IcVCY1x0267AKxVWxJVW8Jr1l84 ACjcxK6I8E87Iv67AKxVWxJr0_GcWl84ACjcxK6I8E87Iv6xkF7I0E14v26rxl6s0DM2AI xVAIcxkEcVAq07x20xvEncxIr21l5I8CrVACY4xI64kE6c02F40Ex7xfMcIj6xIIjxv20x vE14v26r1j6r18McIj6I8E87Iv67AKxVWUJVW8JwAm72CE4IkC6x0Yz7v_Jr0_Gr1lF7xv r2IYc2Ij64vIr41lF7I21c0EjII2zVCS5cI20VAGYxC7M4IIrI8v6xkF7I0E8cxan2IY04 v7MxkF7I0En4kS14v26r4a6rW5MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j 6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7 AF67AKxVW8ZVWrXwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE 2Ix0cI8IcVCY1x0267AKxVWxJVW8Jr1lIxAIcVCF04k26cxKx2IYs7xG6r1j6r1xMIIF0x vEx4A2jsIE14v26r4j6F4UMIIF0xvEx4A2jsIEc7CjxVAFwI0_Gr1j6F4UJbIYCTnIWIev Ja73UjIFyTuYvjTRM6wCDUUUU X-CM-SenderInfo: psxovxtxl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Pu Lehui When CFI is enabled, the actual BPF program entry point is shifted forward by a CFI preamble. During bpf_jit_free(), this shifted pointer causes the wrong ro_header to be fetched, leading to a potential invalid memory free. Fix this by subtracting cfi_get_offset() from prog->bpf_func to correctly restore the original JITed allocation address before freeing. Fixes: e63985ecd226 ("bpf, riscv64/cfi: Support kCFI + BPF on riscv64") Signed-off-by: Pu Lehui --- arch/riscv/net/bpf_jit_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index cbfcd287ea16..059db1adeaf8 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog) kvfree(jit_data->ctx.offset); kfree(jit_data); } + prog->bpf_func =3D (void *)prog->bpf_func - cfi_get_offset(); hdr =3D bpf_jit_binary_pack_hdr(prog); bpf_jit_binary_pack_free(hdr, NULL); WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog)); --=20 2.34.1 From nobody Fri Jul 24 22:56:49 2026 Received: from dggsgout11.his.huawei.com (dggsgout11.his.huawei.com [45.249.212.51]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 388184C9554; Wed, 22 Jul 2026 11:23:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=45.249.212.51 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; cv=none; b=A/WdB8N9zi8FUSdcSA75dxCL10O7oyvlExCWpBF3DVOIRVMfyd5ssZc4opZ4EPWmBalQgzgLrExRZDZbziQ5RdiFyUX1/cSdCI/V8lZoFKOod5fpya+cgN01Nv9FB6spx2eCVqDBxH6AN+oEFPgImNVB2iMKexQGNYBVpVR0zCI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784719411; c=relaxed/simple; bh=anGj889sra5hAL2XwAyOti7iZ48DVrcvDEeXO5I/4go=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=jyxIW0TSFZR6OLreBNTQfJ7MI2nc3tedine6urKVQvzNi5sMxOZbQUn7yMrTjGLSCF8VOJfJjl0AtDiiXyr6TEPUUAnTRX4Tb/voWSLtz1zuErsbX44leeN5aSjKBZR3AsJVRiTIIj6MYQOi/vn1nnB/p24bw4IIZBXpZclRkRE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com; spf=pass smtp.mailfrom=huaweicloud.com; arc=none smtp.client-ip=45.249.212.51 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=huaweicloud.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huaweicloud.com Received: from mail.maildlp.com (unknown [172.19.163.177]) by dggsgout11.his.huawei.com (SkyGuard) with ESMTPS id 4h4sLR5WYYzYQtt5; Wed, 22 Jul 2026 19:22:55 +0800 (CST) Received: from mail02.huawei.com (unknown [10.116.40.128]) by mail.maildlp.com (Postfix) with ESMTP id AFF9E4058F; Wed, 22 Jul 2026 19:23:24 +0800 (CST) Received: from ultra.huawei.com (unknown [10.90.53.71]) by APP4 (Coremail) with UTF8SMTPA id gCh0CgB3qVorqGBqllacCA--.32600S6; Wed, 22 Jul 2026 19:23:24 +0800 (CST) From: Pu Lehui To: bpf@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Eduard Zingerman , Kumar Kartikeya Dwivedi , Martin KaFai Lau , Yonghong Song , Song Liu , Jiri Olsa , Emil Tsalapatis , =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , Puranjay Mohan , Xu Kuohai , Tiezhu Yang , Hengqi Chen , Pu Lehui , Pu Lehui Subject: [PATCH bpf-next 4/4] bpf: Fix double-free RO header in bpf_jit_free Date: Wed, 22 Jul 2026 11:27:54 +0000 Message-Id: <20260722112754.1615201-5-pulehui@huaweicloud.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260722112754.1615201-1-pulehui@huaweicloud.com> References: <20260722112754.1615201-1-pulehui@huaweicloud.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: gCh0CgB3qVorqGBqllacCA--.32600S6 X-Coremail-Antispam: 1UD129KBjvJXoWxGF1DCF43AF13CF1fGF1Dtrb_yoWrCry7pF 1DJF9Ikw4qgw4fJF4Dta18CF4Utw48W3W7WFWUu3y8KFn8Wr92qF1rK34rGFZ8ArWUt34r ZFy5Kr1Yka4kX37anT9S1TB71UUUUU7qnTZGkaVYY2UrUUUUjbIjqfuFe4nvWSU5nxnvy2 9KBjDU0xBIdaVrnRJUUUma14x267AKxVWrJVCq3wAFc2x0x2IEx4CE42xK8VAvwI8IcIk0 rVWrJVCq3wAFIxvE14AKwVWUJVWUGwA2048vs2IY020E87I2jVAFwI0_JF0E3s1l82xGYI kIc2x26xkF7I0E14v26ryj6s0DM28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8wA2 z4x0Y4vE2Ix0cI8IcVAFwI0_JFI_Gr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr 1UM28EF7xvwVC2z280aVAFwI0_Cr1j6rxdM28EF7xvwVC2z280aVCY1x0267AKxVW0oVCq 3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7 IYx2IY67AKxVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4U M4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwACI402YVCY1x02628vn2 kIc2xKxwCY1x0262kKe7AKxVW8ZVWrXwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkE bVWUJVW8JwC20s026c02F40E14v26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67 AF67kF1VAFwI0_GFv_WrylIxkGc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUJVWUCwCI 42IY6xIIjxv20xvEc7CjxVAFwI0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCw CI42IY6I8E87Iv67AKxVW8JVWxJwCI42IY6I8E87Iv6xkF7I0E14v26r4UJVWxJrUvcSsG vfC2KfnxnUUI43ZEXa7sRiHUDtUUUUU== X-CM-SenderInfo: psxovxtxl6x35dzhxuhorxvhhfrp/ Content-Type: text/plain; charset="utf-8" From: Pu Lehui When bpf_jit_binary_pack_finalize fails in bpf_jit_free, it implicitly frees ro_header. However, JITs are unaware of this. They extract and free it again, leading to double-free issue. Fix this by dropping the implicit free in bpf_jit_binary_pack_finalize. Accordingly, adapt the JITs to explicitly handle freeing ro_header in their error paths. This also fixes the missing memory uncharge upon failure, as bpf_prog_pack_free does not uncharge. Fixes: 1d5f82d9dd47 ("bpf, x86: fix freeing of not-finalized bpf_prog_pack") Reported-by: Sashiko Signed-off-by: Pu Lehui --- arch/arm64/net/bpf_jit_comp.c | 2 +- arch/loongarch/net/bpf_jit.c | 2 +- arch/powerpc/net/bpf_jit_comp.c | 4 +++- arch/riscv/net/bpf_jit_core.c | 2 +- arch/x86/net/bpf_jit_comp.c | 2 +- kernel/bpf/core.c | 5 ++--- 6 files changed, 9 insertions(+), 8 deletions(-) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f4e4d4578e38..e200b0207f7a 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2258,7 +2258,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verif= ier_env *env, struct bpf_pr goto out_free_hdr; } if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) { - /* ro_header and header has been freed */ + bpf_jit_binary_pack_free(ro_header, NULL); ro_header =3D NULL; header =3D NULL; goto out_free_hdr; diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c index 3d3ed1677d01..c8c8664dccaf 100644 --- a/arch/loongarch/net/bpf_jit.c +++ b/arch/loongarch/net/bpf_jit.c @@ -2298,7 +2298,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verif= ier_env *env, struct bpf_pr goto out_free; } if (WARN_ON(bpf_jit_binary_pack_finalize(ro_header, header))) { - /* ro_header and header have been freed */ + bpf_jit_binary_pack_free(ro_header, NULL); ro_header =3D NULL; header =3D NULL; goto out_free; diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_com= p.c index 7b07b43575f1..0ca14b7d0b0e 100644 --- a/arch/powerpc/net/bpf_jit_comp.c +++ b/arch/powerpc/net/bpf_jit_comp.c @@ -339,8 +339,10 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifi= er_env *env, struct bpf_pr #endif =20 if (!fp->is_func || extra_pass) { - if (bpf_jit_binary_pack_finalize(fhdr, hdr)) + if (bpf_jit_binary_pack_finalize(fhdr, hdr)) { + bpf_jit_binary_pack_free(fhdr, NULL); goto out_err; + } } =20 fp->bpf_func =3D (void *)fimage; diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index 059db1adeaf8..440d5b965e60 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -154,7 +154,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifie= r_env *env, struct bpf_pr =20 if (!prog->is_func || extra_pass) { if (WARN_ON(bpf_jit_binary_pack_finalize(jit_data->ro_header, jit_data->= header))) { - /* ro_header has been freed */ + bpf_jit_binary_pack_free(jit_data->ro_header, NULL); jit_data->ro_header =3D NULL; jit_data->header =3D NULL; goto out_free_hdr; diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c index de7515ea1bea..d017bb0397b8 100644 --- a/arch/x86/net/bpf_jit_comp.c +++ b/arch/x86/net/bpf_jit_comp.c @@ -3988,7 +3988,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verif= ier_env *env, struct bpf_pr * Both cases are serious bugs and justify WARN_ON. */ if (WARN_ON(bpf_jit_binary_pack_finalize(header, rw_header))) { - /* header has been freed */ + bpf_jit_binary_pack_free(header, NULL); header =3D NULL; goto out_image; } diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 47fe047ad30b..77195911a3b3 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1237,10 +1237,9 @@ int bpf_jit_binary_pack_finalize(struct bpf_binary_h= eader *ro_header, =20 kvfree(rw_header); =20 - if (IS_ERR(ptr)) { - bpf_prog_pack_free(ro_header, ro_header->size); + if (IS_ERR(ptr)) return PTR_ERR(ptr); - } + return 0; } =20 --=20 2.34.1