linux-kernel - Re: bpf leaking memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQKXUWg9uRCPD5ebRXwN4dmBCRUFFM7kN=GxymYz3zU25A@mail.gmail.com>
Date: Fri, 1 Aug 2025 15:41:17 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Jens Axboe <axboe@...nel.dk>, Eduard <eddyz87@...il.com>
Cc: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	"open list:XDP SOCKETS (AF_XDP)" <bpf@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>
Subject: Re: bpf leaking memory

On Fri, Aug 1, 2025 at 9:31 AM Jens Axboe <axboe@...nel.dk> wrote:
>
> Hi,
>
> Current -git (any within the last day or two) leaks memory at boot,
> as reported by kmemleak, see below. This is running debian unstable
> on aarc64.
>
> unreferenced object 0xffff0000c820d000 (size 64):
>   comm "systemd", pid 1, jiffies 4294667980
>   hex dump (first 32 bytes):
>     01 00 00 00 00 00 ff ff 00 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace (crc 84021ac):
>     kmemleak_alloc+0x3c/0x50
>     __kmalloc_node_track_caller_noprof+0x370/0x500
>     krealloc_noprof+0x238/0x300
>     kvrealloc_noprof+0x44/0x100
>     do_check_common+0x2668/0x2d50
>     bpf_check+0x2464/0x2ec0
>     bpf_prog_load+0x5c8/0xba8

Thanks for the report.
Reproed on x86 with just boot and
# echo scan > /sys/kernel/debug/kmemleak
# cat /sys/kernel/debug/kmemleak
unreferenced object 0xff1100010174d000 (size 64):
  comm "systemd", pid 1, jiffies 4294669288
  hex dump (first 32 bytes):
    01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace (crc 8c5ed7af):
    __kmalloc_node_track_caller_noprof+0x338/0x490
    krealloc_noprof+0x1db/0x2a0
    kvrealloc_noprof+0x36/0xb0
    do_check_common+0x2462/0x3290
    bpf_check+0x2c29/0x3770


Eduard,
please take a look.

        for (i = 0; i < env->scc_cnt; ++i) {
                info = env->scc_info[i];

loop is wrong. Nothing updates scc_cnt.