[PATCH bpf-next v3 7/9] bpf, arm64: Fix private stack leak when JIT failed

[Pu Lehui]

From: Pu Lehui <pulehui@xxxxxxxxxx>

When bpf_int_jit_compile fails after allocating the private stack and
ro_header, it jumps to out_free_hdr where bpf_jit_binary_pack_free frees
ro_header but leaves the pointer non-NULL. This causes the subsequent
`if (!ro_header && priv_stack_ptr)` check at out_off to evaluate to
false, skipping free_percpu(priv_stack_ptr) and leaking the private
stack memory.

Fix this by setting ro_header to NULL after freeing it in out_free_hdr.

Fixes: 6c17a882d380 ("bpf, arm64: JIT support for private stack")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Signed-off-by: Pu Lehui <pulehui@xxxxxxxxxx>
---
 arch/arm64/net/bpf_jit_comp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index f4e4d4578e38..6e036acf80d8 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2311,6 +2311,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		bpf_arch_text_copy(&ro_header->size, &header->size,
 				   sizeof(header->size));
 		bpf_jit_binary_pack_free(ro_header, header);
+		ro_header = NULL;
 	}
 	goto out_off;
 }
-- 
2.34.1