Re: [PATCH bpf-next v3 6/9] bpf: keep module BTF until the vmlinux BTF is available
flat view
From: sashiko-bot@kernel.org
Date: 2026-09-25 22:59:16
Also in:
bpf
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] bpf: memory leak of module BTF data on parse failure for .BTF.base modules
--
commit 10719f6f8154699a27d9151dc131b89e1ea34139
Author: Jay Wang [off-list ref]
bpf: keep module BTF until the vmlinux BTF is available
Module BTF is split BTF against the vmlinux BTF and is parsed in the
module notifier. With CONFIG_DEBUG_INFO_BTF=m the vmlinux BTF may not be
loaded yet when a module loads, and the notifier cannot load btf_vmlinux
(that would nest a module load in a module load).
quoted hunk ↗ jump to hunk
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c index 207954b5754a7..1dae1c9b53fed 100644 --- a/kernel/bpf/btf.c +++ b/kernel/bpf/btf.c
[ ... ]
quoted hunk ↗ jump to hunk
@@ -9309,6 +9414,101 @@ static int __init btf_module_init(void) } fs_initcall(btf_module_init); + +#if IS_MODULE(CONFIG_DEBUG_INFO_BTF) +/* + * A kept module whose BTF cannot be used after all. The module is loaded + * and stays, so there is no way to reject it: the entry stays on the list, + * dead, until the module goes. A sysfs file it has keeps serving the raw + * data, which is kept for that. + */ +static void btf_module_dead(struct btf_module *btf_mod, const char *what, int err) +{ + pr_warn("failed to %s module [%s] BTF: %d\n", what, btf_mod->module->name, err); + kvfree(btf_mod->base_data); + btf_mod->base_data = NULL; + btf_free_deferred_regs(&btf_mod->deferred_regs); + btf_mod->gone = true; +}
[Severity: Low] Does this code leak btf_mod->data when parsing fails for modules with a .BTF.base section? If a module with a .BTF.base section is loaded before the vmlinux BTF, and its deferred BTF parsing subsequently fails when the vmlinux BTF is loaded, the memory btf_mod->data is retained because btf_module_dead() assumes the sysfs file will continue to serve the raw data. However, for .BTF.base modules, the sysfs file uses btf_module_sysfs_read_deferred(), which returns -ENODEV when the module is marked as gone. As a result, the memory is inaccessible and uselessly retained until the module is unloaded. -- Sashiko AI review · https://sashiko.dev/#/patchset/20260925224229.1850-1-wanjay@amazon.com?part=6