From d2141481a764efdfaac70965ea28e8925f6a6b80 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Fri, 16 Oct 2026 17:55:59 +0200 Subject: [PATCH] bpf: Free the subprog jump tables once the CFG passes are done The jump tables which compute_subprog_jts() builds are only read through bpf_insn_successors() once CFG discovery is done. Its last caller is bpf_compute_scev(), which runs after bpf_compute_live_registers(), so free the tables right after it instead of keeping them until the verifier environment is torn down. With large insn_array maps, this also drops them before do_check() starts to allocate states. Dead code removal runs after do_check(), so a removed subprogram no longer owns a table and adjust_subprog_starts_after_remove() can go back to not caring about the table pointers. Suggested-by: Alexei Starovoitov Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Link: https://patch.msgid.link/20261016155559.652461-1-daniel@iogearbox.net --- kernel/bpf/fixups.c | 9 +-------- kernel/bpf/verifier.c | 2 ++ 2 files changed, 3 insertions(+), 8 deletions(-) diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index b2fa7e8bedf3..608621d7f225 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -477,11 +477,7 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, if (j > i) { struct bpf_prog_aux *aux = env->prog->aux; - int move, k; - - /* The removed subprogs own their jump tables. */ - for (k = i; k < j; k++) - kvfree(env->subprog_info[k].jt); + int move; /* move fake 'exit' subprog as well */ move = env->subprog_cnt + 1 - j; @@ -489,9 +485,6 @@ static int adjust_subprog_starts_after_remove(struct bpf_verifier_env *env, memmove(env->subprog_info + i, env->subprog_info + j, sizeof(*env->subprog_info) * move); - /* The vacated tail still holds copies of the moved entries. */ - memset(env->subprog_info + i + move, 0, - sizeof(*env->subprog_info) * (j - i)); env->subprog_cnt -= j - i; /* remove func_info and its aux */ diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index ec136cf377c1..62f8951126ba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -23487,6 +23487,8 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, if (ret < 0) goto skip_full_check; + bpf_free_subprog_jts(env); + ret = mark_fastcall_patterns(env); if (ret < 0) goto skip_full_check;