bpf_int_jit_compile() allocates the private stack of a program before the sizing passes and frees it on the way out when ro_header is NULL, which is only the case when the JIT fails before the image is allocated, or when the pack finalize fails, which clears the pointer. A failure in the passes over the image, or in the extra pass of a subprog, frees the image but leaves ro_header set, so the private stack stays allocated behind prog->aux->priv_stack_ptr of a program that is not jited, which bpf_jit_free() then skips. Clear ro_header and header once the image is freed, so that the exit path frees the private stack as it does for a failure before the allocation, like the x86 JIT does with its image pointer. Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack") Signed-off-by: Daniel Borkmann --- arch/arm64/net/bpf_jit_comp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c index 19c986440235..27f0194ce0fd 100644 --- a/arch/arm64/net/bpf_jit_comp.c +++ b/arch/arm64/net/bpf_jit_comp.c @@ -2539,6 +2539,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr bpf_arch_text_copy(&ro_header->size, &header->size, sizeof(header->size)); bpf_jit_binary_pack_free(ro_header, header); + /* The private stack goes with the image, see out_off */ + ro_header = NULL; + header = NULL; } goto out_off; } -- 2.43.0