Patch "bpf: Fix memleak due to fentry attach failure" has been added to the 6.3-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix memleak due to fentry attach failure

to the 6.3-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-memleak-due-to-fentry-attach-failure.patch
and it can be found in the queue-6.3 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4cd2d3eefd705329047c8c8bf856cfba9de64b49
Author: Yafang Shao <laoar.shao@xxxxxxxxx>
Date:   Mon May 15 13:08:47 2023 +0000

    bpf: Fix memleak due to fentry attach failure
    
    [ Upstream commit 108598c39eefbedc9882273ac0df96127a629220 ]
    
    If it fails to attach fentry, the allocated bpf trampoline image will be
    left in the system. That can be verified by checking /proc/kallsyms.
    
    This meamleak can be verified by a simple bpf program as follows:
    
      SEC("fentry/trap_init")
      int fentry_run()
      {
          return 0;
      }
    
    It will fail to attach trap_init because this function is freed after
    kernel init, and then we can find the trampoline image is left in the
    system by checking /proc/kallsyms.
    
      $ tail /proc/kallsyms
      ffffffffc0613000 t bpf_trampoline_6442453466_1  [bpf]
      ffffffffc06c3000 t bpf_trampoline_6442453466_1  [bpf]
    
      $ bpftool btf dump file /sys/kernel/btf/vmlinux | grep "FUNC 'trap_init'"
      [2522] FUNC 'trap_init' type_id=119 linkage=static
    
      $ echo $((6442453466 & 0x7fffffff))
      2522
    
    Note that there are two left bpf trampoline images, that is because the
    libbpf will fallback to raw tracepoint if -EINVAL is returned.
    
    Fixes: e21aa341785c ("bpf: Fix fexit trampoline.")
    Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Song Liu <song@xxxxxxxxxx>
    Cc: Jiri Olsa <olsajiri@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20230515130849.57502-2-laoar.shao@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index 213d9b3cb06ad..fecb8d2d885a3 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -279,11 +279,8 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a
 	return tlinks;
 }
 
-static void __bpf_tramp_image_put_deferred(struct work_struct *work)
+static void bpf_tramp_image_free(struct bpf_tramp_image *im)
 {
-	struct bpf_tramp_image *im;
-
-	im = container_of(work, struct bpf_tramp_image, work);
 	bpf_image_ksym_del(&im->ksym);
 	bpf_jit_free_exec(im->image);
 	bpf_jit_uncharge_modmem(PAGE_SIZE);
@@ -291,6 +288,14 @@ static void __bpf_tramp_image_put_deferred(struct work_struct *work)
 	kfree_rcu(im, rcu);
 }
 
+static void __bpf_tramp_image_put_deferred(struct work_struct *work)
+{
+	struct bpf_tramp_image *im;
+
+	im = container_of(work, struct bpf_tramp_image, work);
+	bpf_tramp_image_free(im);
+}
+
 /* callback, fexit step 3 or fentry step 2 */
 static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu)
 {
@@ -465,7 +470,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
 					  &tr->func.model, tr->flags, tlinks,
 					  tr->func.addr);
 	if (err < 0)
-		goto out;
+		goto out_free;
 
 	set_memory_rox((long)im->image, 1);
 
@@ -494,7 +499,7 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
 	}
 #endif
 	if (err)
-		goto out;
+		goto out_free;
 
 	if (tr->cur_image)
 		bpf_tramp_image_put(tr->cur_image);
@@ -505,6 +510,10 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr, bool lock_direct_mut
 		tr->flags = orig_flags;
 	kfree(tlinks);
 	return err;
+
+out_free:
+	bpf_tramp_image_free(im);
+	goto out;
 }
 
 static enum bpf_tramp_prog_type bpf_attach_type_to_tramp(struct bpf_prog *prog)