From: Pu Lehui When bpf_int_jit_compile fails after allocating the private stack and ro_header, it jumps to out_free_hdr where bpf_jit_binary_pack_free frees ro_header but leaves the pointer non-NULL. This causes the subsequent `if (!ro_header && priv_stack_ptr)` check at out_off to evaluate to false, skipping free_percpu(priv_stack_ptr) and leaking the private stack memory. Fix this by setting ro_header to NULL after freeing it in out_free_hdr. Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack") Reported-by: Sashiko Signed-off-by: Pu Lehui --- arch/arm64/net/bpf_jit_comp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index f4e4d4578e38..6e036acf80d8 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2311,6 +2311,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr bpf_arch_text_copy(&ro_header->size, &header->size, sizeof(header->size)); bpf_jit_binary_pack_free(ro_header, header); + ro_header = NULL; } goto out_off; } -- 2.34.1