Wang Yufen eb86559a69 bpf: Fix memory leaks in __check_func_call ... kmemleak reports this issue: unreferenced object 0xffff88817139d000 (size 2048): comm "test_progs", pid 33246, jiffies 4307381979 (age 45851.820s) hex dump (first 32 bytes): 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<0000000045f075f0>] kmalloc_trace+0x27/0xa0 [<0000000098b7c90a>] __check_func_call+0x316/0x1230 [<00000000b4c3c403>] check_helper_call+0x172e/0x4700 [<00000000aa3875b7>] do_check+0x21d8/0x45e0 [<000000001147357b>] do_check_common+0x767/0xaf0 [<00000000b5a595b4>] bpf_check+0x43e3/0x5bc0 [<0000000011e391b1>] bpf_prog_load+0xf26/0x1940 [<0000000007f765c0>] __sys_bpf+0xd2c/0x3650 [<00000000839815d6>] __x64_sys_bpf+0x75/0xc0 [<00000000946ee250>] do_syscall_64+0x3b/0x90 [<0000000000506b7f>] entry_SYSCALL_64_after_hwframe+0x63/0xcd The root case here is: In function prepare_func_exit(), the callee is not released in the abnormal scenario after "state->curframe--;". To fix, move "state->curframe--;" to the very bottom of the function, right when we free callee and reset frame[] pointer to NULL, as Andrii suggested. In addition, function __check_func_call() has a similar problem. In the abnormal scenario before "state->curframe++;", the callee also should be released by free_func_state(). Fixes: 69c087ba62 ("bpf: Add bpf_for_each_map_elem() helper") Fixes: fd978bf7fd ("bpf: Add reference tracking to verifier") Signed-off-by: Wang Yufen <wangyufen@huawei.com> Link: https://lore.kernel.org/r/1667884291-15666-1-git-send-email-wangyufen@huawei.com Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>		2022-11-08 09:21:35 -08:00
..
preload	bpf: iterators: Build and use lightweight bootstrap version of bpftool	2022-07-15 12:01:30 -07:00
arraymap.c	bpf: Support kptrs in percpu arraymap	2022-09-07 11:46:08 -07:00
bloom_filter.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
bpf_inode_storage.c	bpf: Compute map_btf_id during build time	2022-04-26 11:35:21 -07:00
bpf_iter.c	bpf: Initialize the bpf_run_ctx in bpf_iter_run_prog()	2022-08-18 17:06:13 -07:00
bpf_local_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-09-01 12:16:12 -07:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-02-10 15:54:26 -08:00
bpf_lru_list.h	printk: stop including cache.h from printk.h	2022-05-13 07:20:07 -07:00
bpf_lsm.c	Networking changes for 6.1.	2022-10-04 13:38:03 -07:00
bpf_struct_ops.c	bpf: Remove is_valid_bpf_tramp_flags()	2022-07-11 21:04:58 +02:00
bpf_struct_ops_types.h	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpf_task_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-09-01 12:16:12 -07:00
btf.c	bpf: prevent decl_tag from being referenced in func_proto	2022-10-17 10:56:12 -07:00
cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
cgroup_iter.c	bpf: cgroup_iter: support cgroup1 using cgroup fd	2022-10-11 06:50:15 -10:00
core.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
cpumap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
devmap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
disasm.c	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c	bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE()	2022-11-07 16:07:35 -08:00
hashtab.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
helpers.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
inode.c	bpf: Convert bpf_preload.ko to use light skeleton.	2022-02-10 23:31:51 +01:00
Kconfig	rcu: Make the TASKS_RCU Kconfig option be selected	2022-04-20 16:52:58 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
lpm_trie.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
Makefile	bpf: Introduce any context BPF specific memory allocator.	2022-09-05 15:33:05 +02:00
map_in_map.c	bpf: Allow storing unreferenced kptr in map	2022-04-25 17:31:35 -07:00
map_in_map.h
map_iter.c	bpf: Introduce MEM_RDONLY flag	2021-12-18 13:27:41 -08:00
memalloc.c	bpf: Use __llist_del_all() whenever possbile during memory draining	2022-10-21 19:17:38 -07:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
percpu_freelist.c	bpf: Simplify code by using for_each_cpu_wrap()	2022-09-10 16:18:55 -07:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c	bpf: Remove unneeded memset in queue_stack_map creation	2022-08-10 11:48:22 -07:00
reuseport_array.c	net: Fix suspicious RCU usage in bpf_sk_reuseport_detach()	2022-08-17 16:42:59 -07:00
ringbuf.c	bpf: Add bpf_user_ringbuf_drain() helper	2022-09-21 16:24:58 -07:00
stackmap.c	perf/bpf: Always use perf callchains if exist	2022-09-13 15:03:22 +02:00
syscall.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
sysfs_btf.c
task_iter.c	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
tnum.c	bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul	2021-06-01 13:34:15 +02:00
trampoline.c	bpf: Add __bpf_prog_{enter,exit}_struct_ops for struct_ops trampoline	2022-09-29 09:25:47 -07:00
verifier.c	bpf: Fix memory leaks in __check_func_call	2022-11-08 09:21:35 -08:00