linux-kernel - Re: [PATCH bpf] selftests/bpf: Fix resource leak in serial_test

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALEuBam-2=QcXHH81RPdEcQ6zguY8EjzUt-Rh3BW=fn4F7vi_Q@mail.gmail.com>
Date: Thu, 22 Jan 2026 01:49:06 +0800
From: Kery Qi <qikeyu2017@...il.com>
To: Yonghong Song <yonghong.song@...ux.dev>
Cc: ast@...nel.org, daniel@...earbox.net, andrii@...nel.org, shuah@...nel.org, 
	martin.lau@...ux.dev, eddyz87@...il.com, song@...nel.org, 
	john.fastabend@...il.com, kpsingh@...nel.org, sdf@...ichev.me, 
	haoluo@...gle.com, jolsa@...nel.org, yatsenko@...a.com, bentiss@...nel.org, 
	bpf@...r.kernel.org, linux-kselftest@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf] selftests/bpf: Fix resource leak in serial_test_wq on
 attach failure

Hi,

Thank you for the review.

You are completely right regarding wq__open_and_load(): if it fails,
it returns NULL and performs its own cleanup, so an immediate return
is correct there.

However, my concern is about the next step: wq__attach(wq_skel).

If wq__open_and_load() succeeds, wq_skel is allocated. If wq__attach()
subsequently fails, the original code returns immediately without
calling wq__destroy(wq_skel), which causes a memory leak of the
skeleton object.

The proposed goto clean_up is intended to ensure wq__destroy(wq_skel)
is called specifically when wq__attach() fails.

Does that make sense?

Best regards,

Kery

Yonghong Song <yonghong.song@...ux.dev> 于2026年1月21日周三 23:45写道：
>
>
>
> On 1/21/26 1:41 AM, Kery Qi wrote:
> > When wq__attach() fails, serial_test_wq() returns early without calling
> > wq__destroy(), leaking the skeleton resources allocated by
> > wq__open_and_load(). This causes ASAN leak reports in selftests runs.
> >
> > Fix this by jumping to a common clean_up label that calls wq__destroy()
> > on all exit paths after successful open_and_load.
> >
> > Note that the early return after wq__open_and_load() failure is correct
> > and doesn't need fixing, since that function returns NULL on failure
> > (after internally cleaning up any partial allocations).
> >
> > Fixes: 8290dba51910 ("selftests/bpf: wq: add bpf_wq_start() checks")
> > Signed-off-by: Kery Qi <qikeyu2017@...il.com>
>
> Acked-by: Yonghong Song <yonghong.song@...ux.dev>
>