[PATCH bpf-next] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[PATCH bpf-next] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[Pu Lehui]

From: Pu Lehui <pulehui@huawei.com>

When CFI is enabled, the actual BPF program entry point is shifted
forward by a CFI preamble. During bpf_jit_free(), this shifted pointer
causes the wrong ro_header to be fetched, leading to a potential invalid
memory free.

Fix this by subtracting cfi_get_offset() from prog->bpf_func to
correctly restore the original JITed allocation address before freeing.

Fixes: e63985ecd226 ("bpf, riscv64/cfi: Support kCFI + BPF on riscv64")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
---
- Separate from the patch series [0].
[0] https://lore.kernel.org/bpf/20260725154915.2488611-1-pulehui@huaweicloud.com

 arch/riscv/net/bpf_jit_core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
index 2fb0b4e198b9..470a6ace5662 100644
--- a/arch/riscv/net/bpf_jit_core.c
+++ b/arch/riscv/net/bpf_jit_core.c
@@ -244,6 +244,7 @@ void bpf_jit_free(struct bpf_prog *prog)
 			kvfree(jit_data->ctx.offset);
 			kfree(jit_data);
 		}
+		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
 		hdr = bpf_jit_binary_pack_hdr(prog);
 		bpf_jit_binary_pack_free(hdr, NULL);
 		WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog));
-- 
2.34.1

Re: [PATCH bpf-next] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[Björn Töpel]

Pu Lehui <pulehui@huaweicloud.com> writes:

> From: Pu Lehui <pulehui@huawei.com>
>
> When CFI is enabled, the actual BPF program entry point is shifted
> forward by a CFI preamble. During bpf_jit_free(), this shifted pointer
> causes the wrong ro_header to be fetched, leading to a potential invalid
> memory free.
>
> Fix this by subtracting cfi_get_offset() from prog->bpf_func to
> correctly restore the original JITed allocation address before freeing.
>
> Fixes: e63985ecd226 ("bpf, riscv64/cfi: Support kCFI + BPF on riscv64")
> Signed-off-by: Pu Lehui <pulehui@huawei.com>

Reviewed-by: Björn Töpel <bjorn@kernel.org>
Acked-by: Björn Töpel <bjorn@kernel.org>

Re: [PATCH bpf-next] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Wed, 23 Sep 2026 14:42:16 +0000 you wrote:
> From: Pu Lehui <pulehui@huawei.com>
> 
> When CFI is enabled, the actual BPF program entry point is shifted
> forward by a CFI preamble. During bpf_jit_free(), this shifted pointer
> causes the wrong ro_header to be fetched, leading to a potential invalid
> memory free.
> 
> [...]

Here is the summary with links:
  - [bpf-next] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free
    https://git.kernel.org/bpf/bpf-next/c/93df8ae3267f

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html