Re: [PATCH bpf-next v3 02/16] bpf: Convert bpf_selem_link_map to failable
From: bot+bpf-ci@kernel.org
Date: 2025-12-18 18:19:02
Also in:
bpf
quoted hunk ↗ jump to hunk
diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c index 850dd736ccd1..4f8e917f49d9 100644 --- a/net/core/bpf_sk_storage.c +++ b/net/core/bpf_sk_storage.c@@ -191,7 +191,9 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk) } if (new_sk_storage) { - bpf_selem_link_map(smap, copy_selem); + ret = bpf_selem_link_map(smap, copy_selem); + if (ret) + goto out; bpf_selem_link_storage_nolock(new_sk_storage, copy_selem); } else { ret = bpf_local_storage_alloc(newsk, smap, copy_selem, GFP_ATOMIC);
When bpf_selem_link_map() fails, is there missing cleanup here? Looking
at the else branch below (bpf_local_storage_alloc failure), the error
handling includes:
- bpf_selem_free(copy_selem, true)
- atomic_sub(smap->elem_size, &newsk->sk_omem_alloc)
- bpf_map_put(map)
The new error path for bpf_selem_link_map() failure goes directly to the
out label without any of this cleanup. At this point in the code:
- copy_selem was allocated by bpf_sk_storage_clone_elem() and charged
via bpf_selem_alloc()->mem_charge()
- map reference was taken via bpf_map_inc_not_zero()
- copy_selem has not yet been linked to new_sk_storage (that happens
in bpf_selem_link_storage_nolock() after the failing call)
The comment at the out label says the caller is responsible for cleanup
via bpf_sk_storage_free(), but since copy_selem was never linked to the
storage list, bpf_local_storage_destroy() will not find it.
Currently this is not triggerable since bpf_selem_link_map() always
returns 0, but commit 615477732ee8 ("bpf: Change local_storage->lock and
b->lock to rqspinlock") later in this series makes the function actually
return errors.
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/20346662777