Commit f6fddc6d authored by Shardul Bankar's avatar Shardul Bankar Committed by Martin KaFai Lau
Browse files

bpf: Fix memory leak in __lookup_instance error path 



When __lookup_instance() allocates a func_instance structure but fails
to allocate the must_write_set array, it returns an error without freeing
the previously allocated func_instance. This causes a memory leak of 192
bytes (sizeof(struct func_instance)) each time this error path is triggered.

Fix by freeing 'result' on must_write_set allocation failure.

Fixes: b3698c35 ("bpf: callchain sensitive stack liveness tracking using CFG")
Reported-by: BPF Runtime Fuzzer (BRF)
Signed-off-by: default avatarShardul Bankar <shardulsb08@gmail.com>
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20251016063330.4107547-1-shardulsb08@gmail.com
parent 0c1999ed

kernel/bpf/liveness.c

+3 −1
Original line number Diff line number Diff line
@@ -195,8 +195,10 @@ static struct func_instance *__lookup_instance(struct bpf_verifier_env *env, 
		return ERR_PTR(-ENOMEM);

	result->must_write_set = kvcalloc(subprog_sz, sizeof(*result->must_write_set),

					  GFP_KERNEL_ACCOUNT);

	if (!result->must_write_set)

	if (!result->must_write_set) {

		kvfree(result);

		return ERR_PTR(-ENOMEM);

	}

	memcpy(&result->callchain, callchain, sizeof(*callchain));

	result->insn_cnt = subprog_sz;

	hash_add(liveness->func_instances, &result->hl_node, key);