On Mon, May 15, 2023 at 6:09 AM Yafang Shao <laoar.shao@xxxxxxxxx> wrote:
>
> If it fails to attach fentry, the allocated bpf trampoline image will be
> left in the system. That can be verified by checking /proc/kallsyms.
>
> This meamleak can be verified by a simple bpf program as follows,
>
> SEC("fentry/trap_init")
> int fentry_run()
> {
> return 0;
> }
>
> It will fail to attach trap_init because this function is freed after
> kernel init, and then we can find the trampoline image is left in the
> system by checking /proc/kallsyms.
> $ tail /proc/kallsyms
> ffffffffc0613000 t bpf_trampoline_6442453466_1 [bpf]
> ffffffffc06c3000 t bpf_trampoline_6442453466_1 [bpf]
>
> $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
> [2522] FUNC 'trap_init' type_id=119 linkage=static
>
> $ echo $((6442453466 & 0x7fffffff))
> 2522
>
> Note that there are two left bpf trampoline images, that is because the
> libbpf will fallback to raw tracepoint if -EINVAL is returned.
>
> Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
> Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
> Cc: Song Liu <song@xxxxxxxxxx>
> Cc: Jiri Olsa <olsajiri@xxxxxxxxx>
Acked-by: Song Liu <song@xxxxxxxxxx>
