Re: [PATCH v2 5/6] s390/bpf: Add kCFI support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The s390 BPF JIT leaks `s390_jit_data` and its associated `jit.addrs` array when JIT compilation fails during a multi-subprogram compilation.
--

--- Patch [5]: [PATCH v2 5/6] s390/bpf: Add kCFI support ---
commit 90cf9cf344f10dd1f477562c9b9f57c7b89998a9
Author: Heiko Carstens <hca@linux.ibm.com>

s390/bpf: Add kCFI support

This commit adds kCFI support for BPF on the s390 architecture, mirroring
the existing arm64 implementation.

> diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
> --- a/arch/s390/net/bpf_jit_comp.c
> +++ b/arch/s390/net/bpf_jit_comp.c

[ ... ]

> @@ -2401,11 +2417,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  		jit_data->ctx = jit;
>  		jit_data->pass = pass;
>  	}
> -	fp->bpf_func = (void *) jit.prg_buf;
> +	fp->bpf_func = (void *)jit.prg_buf + cfi_get_offset();
>  	fp->jited = 1;
> -	fp->jited_len = jit.size;
> +	fp->jited_len = jit.size - cfi_get_offset();
>  
>  	if (!fp->is_func || extra_pass) {
> +		for (int i = 0; i < fp->len; i++)
> +			jit.addrs[i] -= cfi_get_offset();
>  		bpf_prog_fill_jited_linfo(fp, jit.addrs + 1);
>  free_addrs:
>  		kvfree(jit.addrs);

[Severity: High]
This is a pre-existing issue, but does this code leak jit_data and jit.addrs
when JIT compilation fails during a multi-subprogram compilation?

When extra_pass is false and fp->is_func is true in bpf_int_jit_compile(),
the function skips the block above and returns without freeing jit.addrs
and jit_data.

These resources rely on bpf_jit_free() for cleanup on error paths, such as
when a subsequent subprogram fails to JIT. However, since s390 does not
implement a custom bpf_jit_free(), the generic version in kernel/bpf/core.c
is called. This generic function only frees the binary header and leaves
fp->aux->jit_data behind.

Could this be repeatedly triggered by a user loading a multi-subprogram BPF
object that fails during JIT, potentially leading to resource exhaustion?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727140514.116501-1-hca@linux.ibm.com?part=5