When a pass over the image fails, including the extra pass of a subprog, the image is freed but ro_header is left set. The exit path then skips freeing the private stack. It stays allocated behind priv_stack_ptr, and bpf_jit_free() does not free it either, as the program is not marked as JITed. Clear ro_header and header once the image is freed, so that the exit path frees the private stack as it does for failures before the image was allocated. The x86 JIT does the same with its image pointer. Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack") Signed-off-by: Daniel Borkmann --- arch/arm64/net/bpf_jit_comp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index e72bf79d219c..976282418909 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2564,6 +2564,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr bpf_arch_text_copy(&ro_header->size, &header->size, sizeof(header->size)); bpf_jit_binary_pack_free(ro_header, header); + /* The private stack goes with the image, see out_off */ + ro_header = NULL; + header = NULL; } goto out_off; } -- 2.43.0