Patch "bpf: Call the missed btf_record_free() when map creation fails" has been added to the 6.11-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Call the missed btf_record_free() when map creation fails

to the 6.11-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-call-the-missed-btf_record_free-when-map-creatio.patch
and it can be found in the queue-6.11 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 5945fb4ed067093a7915eb92d59509a3168cf836
Author: Hou Tao <houtao1@xxxxxxxxxx>
Date:   Thu Sep 12 09:28:44 2024 +0800

    bpf: Call the missed btf_record_free() when map creation fails
    
    [ Upstream commit 87e9675a0dfd0bf4a36550e4a0e673038ec67aee ]
    
    When security_bpf_map_create() in map_create() fails, map_create() will
    call btf_put() and ->map_free() callback to free the map. It doesn't
    free the btf_record of map value, so add the missed btf_record_free()
    when map creation fails.
    
    However btf_record_free() needs to be called after ->map_free() just
    like bpf_map_free_deferred() did, because ->map_free() may use the
    btf_record to free the special fields in preallocated map value. So
    factor out bpf_map_free() helper to free the map, btf_record, and btf
    orderly and use the helper in both map_create() and
    bpf_map_free_deferred().
    
    Signed-off-by: Hou Tao <houtao1@xxxxxxxxxx>
    Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240912012845.3458483-2-houtao@xxxxxxxxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index d9cae8e259699..21fb9c4d498fb 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -733,15 +733,11 @@ void bpf_obj_free_fields(const struct btf_record *rec, void *obj)
 	}
 }
 
-/* called from workqueue */
-static void bpf_map_free_deferred(struct work_struct *work)
+static void bpf_map_free(struct bpf_map *map)
 {
-	struct bpf_map *map = container_of(work, struct bpf_map, work);
 	struct btf_record *rec = map->record;
 	struct btf *btf = map->btf;
 
-	security_bpf_map_free(map);
-	bpf_map_release_memcg(map);
 	/* implementation dependent freeing */
 	map->ops->map_free(map);
 	/* Delay freeing of btf_record for maps, as map_free
@@ -760,6 +756,16 @@ static void bpf_map_free_deferred(struct work_struct *work)
 	btf_put(btf);
 }
 
+/* called from workqueue */
+static void bpf_map_free_deferred(struct work_struct *work)
+{
+	struct bpf_map *map = container_of(work, struct bpf_map, work);
+
+	security_bpf_map_free(map);
+	bpf_map_release_memcg(map);
+	bpf_map_free(map);
+}
+
 static void bpf_map_put_uref(struct bpf_map *map)
 {
 	if (atomic64_dec_and_test(&map->usercnt)) {
@@ -1411,8 +1417,7 @@ static int map_create(union bpf_attr *attr)
 free_map_sec:
 	security_bpf_map_free(map);
 free_map:
-	btf_put(map->btf);
-	map->ops->map_free(map);
+	bpf_map_free(map);
 put_token:
 	bpf_token_put(token);
 	return err;