When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also
needs to be freed. Otherwise, the map memory will not be reclaimed, just
like the memory leak problem reported by syzbot [1]. 

syzbot reported:
BUG: memory leak
  backtrace (crc 7b9fb9b4):
    map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
    __sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131

Fixes: baefdbdf6812 ("bpf: Implement exclusive map creation")
Reported-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=cf08c551fecea9fd1320
Tested-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 kernel/bpf/syscall.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8a129746bd6c..aa0979e8de15 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -1585,7 +1585,8 @@ static int map_create(union bpf_attr *attr, bpfptr_t uattr)
 			goto free_map;
 		}
 	} else if (attr->excl_prog_hash_size) {
-		return -EINVAL;
+		err = -EINVAL;
+		goto free_map;
 	}
 
 	err = security_bpf_map_create(map, attr, token, uattr.is_kernel);
-- 
2.43.0

On 11/16/25 6:58 AM, Edward Adam Davis wrote:
> When excl_prog_hash is 0 and excl_prog_hash_size is non-zero, the map also
> needs to be freed. Otherwise, the map memory will not be reclaimed, just
> like the memory leak problem reported by syzbot [1].
>
> syzbot reported:
> BUG: memory leak
>    backtrace (crc 7b9fb9b4):
>      map_create+0x322/0x11e0 kernel/bpf/syscall.c:1512
>      __sys_bpf+0x3556/0x3610 kernel/bpf/syscall.c:6131
>
> Fixes: baefdbdf6812 ("bpf: Implement exclusive map creation")
> Reported-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=cf08c551fecea9fd1320
> Tested-by: syzbot+cf08c551fecea9fd1320@syzkaller.appspotmail.com
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>