bpf: Fix memory leak in __lookup_instance error path

When __lookup_instance() allocates a func_instance structure but fails
to allocate the must_write_set array, it returns an error without freeing
the previously allocated func_instance. This causes a memory leak of 192
bytes (sizeof(struct func_instance)) each time this error path is triggered.

Fix by freeing 'result' on must_write_set allocation failure.

Fixes: b3698c356ad9 ("bpf: callchain sensitive stack liveness tracking using CFG")
Reported-by: BPF Runtime Fuzzer (BRF)
Signed-off-by: Shardul Bankar <shardulsb08@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://patch.msgid.link/20251016063330.4107547-1-shardulsb08@gmail.com

diff --git a/kernel/bpf/liveness.c b/kernel/bpf/liveness.c
index 3c611aba7f52c541408627b780ea664776145e8b..1e6538f59a78601a92e4286f94dcced32cc03528 100644 (file)
--- a/kernel/bpf/liveness.c
+++ b/kernel/bpf/liveness.c
@@ -195,8 +195,10 @@ static struct func_instance *__lookup_instance(struct bpf_verifier_env *env,
                return ERR_PTR(-ENOMEM);
        result->must_write_set = kvcalloc(subprog_sz, sizeof(*result->must_write_set),
                                          GFP_KERNEL_ACCOUNT);
-       if (!result->must_write_set)
+       if (!result->must_write_set) {
+               kvfree(result);
                return ERR_PTR(-ENOMEM);
+       }
        memcpy(&result->callchain, callchain, sizeof(*callchain));
        result->insn_cnt = subprog_sz;
        hash_add(liveness->func_instances, &result->hl_node, key);