Re: XDP BPF JIT memory leak on armv7

[Daniel Borkmann <daniel@iogearbox.net>]

On 4/17/26 1:24 PM, Daniel Borkmann wrote:
> On 4/17/26 11:56 AM, Puranjay Mohan wrote:
>>> On 2026-04-16 16:36, Daniel Borkmann wrote:
>>>> I don't have access to arm32, but it looks like its completely missing the
>>>> ability to do BPF to BPF calls.. you would need something like the below
>>>> (uncompiled / untested).
>>>
>>> Applying your Patch to latest master leads to a paging error [1] and
>>> segmentation fault in xdp_program__attach when I run
>>> ./xdp_pass_user -d lo
>>>
>>>> I think the problem is that BPF to BPF calls are not supported but the
>>>> JIT doesn't reject them as well, so the best way to fix this would be
>>>> to do:
>>>>
>>>> diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
>>>> index deeb8f292454..91fef10e88bc 100644
>>>> --- a/arch/arm/net/bpf_jit_32.c
>>>> +++ b/arch/arm/net/bpf_jit_32.c
>>>> @@ -2047,6 +2047,8 @@ static int build_insn(const struct bpf_insn
>>>> *insn, struct jit_ctx *ctx)
>>>>           /* function call */
>>>>           case BPF_JMP | BPF_CALL:
>>>>           {
>>>> +               if (insn->src_reg == BPF_PSEUDO_CALL)
>>>> +                       goto notyet;
>>>>                   const s8 *r0 = bpf2a32[BPF_REG_0];
>>>>                   const s8 *r1 = bpf2a32[BPF_REG_1];
>>>>                   const s8 *r2 = bpf2a32[BPF_REG_2];
>>>>
>>>> This will cause the memory to be freed properly.
>>>
>>> This works for me and resolves the issue.
>>>
>>> Tested-by: Jonas Rebmann <jre@pengutronix.de>
>>
>> Thanks for testing, let me send the patch to the list.
> 
> Sounds good, I think it might also be worth to check the other
> JITs which are not mainstream to see if they have the extra
> pass and if not then adding similar not-yet bailout to them.
Could probably be done in one sweep via a similar mechanism we
have for kfuncs (bpf_jit_supports_kfunc_call), then verifier
can also print a more meaningful message to the user.