Re: [PATCH bpf-next v2 6/7] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] bpf_jit_free() ignores the return value of bpf_jit_binary_pack_finalize(), leading to a double free and use-after-free of the ro_header if finalization fails.
--

--- Patch [6]: [PATCH bpf-next v2 6/7] riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free ---
commit 3086c59fad7254d5809adea2a09ea130ccb95d10
Author: Pu Lehui <pulehui@huawei.com>

riscv, bpf: Adjust bpf_func to account for CFI offset in bpf_jit_free

This commit subtracts cfi_get_offset() from prog->bpf_func to correctly
restore the original JITed allocation address before freeing it. This prevents
potential invalid memory frees when CFI is enabled.

> diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c
> index cbfcd287ea166..059db1adeaf8d 100644
> --- a/arch/riscv/net/bpf_jit_core.c
> +++ b/arch/riscv/net/bpf_jit_core.c
> @@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog)
>  			kvfree(jit_data->ctx.offset);
>  			kfree(jit_data);
>  		}
> +		prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset();
>  		hdr = bpf_jit_binary_pack_hdr(prog);
>  		bpf_jit_binary_pack_free(hdr, NULL);

[Severity: Critical]
This is a pre-existing issue, but does ignoring the return value of
bpf_jit_binary_pack_finalize() called just above this block lead to a double
free?

If bpf_jit_binary_pack_finalize() fails during text patching, it frees the
ro_header internally and returns an error.

Since that error is ignored in bpf_jit_free(), the execution unconditionally
continues down to:

    hdr = bpf_jit_binary_pack_hdr(prog);
    bpf_jit_binary_pack_free(hdr, NULL);

Can this lead to a use-after-free when bpf_jit_binary_pack_free() tries to
read the header size, followed by a double free of the memory chunk?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725102020.2287770-1-pulehui@huaweicloud.com?part=6