Re: [PATCH 6/6] s390/bpf: Add kCFI support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] BPF line info offsets are shifted by 4 bytes due to double-counting the CFI hash size in `bpf_prog_fill_jited_linfo()`.
--

--- Patch [6]: [PATCH 6/6] s390/bpf: Add kCFI support ---
commit 07d29b72daf2643a639d32a0ab6a9b913adcfbc6
Author: Heiko Carstens <hca@linux.ibm.com>

s390/bpf: Add kCFI support

This patch adds kCFI (Kernel Control Flow Integrity) support for BPF programs 
on the s390 architecture. It emits a CFI hash before the BPF program 
instructions and adjusts the function pointer and lengths to account for 
this prefix.

> diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
> index 31749c0362ca2..74642e0b4ee19 100644
> --- a/arch/s390/net/bpf_jit_comp.c
> +++ b/arch/s390/net/bpf_jit_comp.c

[ ... ]

> @@ -2401,9 +2417,9 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
>  		jit_data->ctx = jit;
>  		jit_data->pass = pass;
>  	}
> -	fp->bpf_func = (void *) jit.prg_buf;
> +	fp->bpf_func = (void *)jit.prg_buf + cfi_get_offset();
>  	fp->jited = 1;
> -	fp->jited_len = jit.size;
> +	fp->jited_len = jit.size - cfi_get_offset();
>  
>  	if (!fp->is_func || extra_pass) {
>  		bpf_prog_fill_jited_linfo(fp, jit.addrs + 1);

[Severity: Medium]
Does this double-count the CFI offset when calculating the JIT line info?

Looking at bpf_int_jit_compile(), the emit_kcfi() call during the prologue 
generation advances jit.prg by 4 bytes. This means the offsets stored in 
jit.addrs already include the CFI hash size.

However, when we pass these offsets to bpf_prog_fill_jited_linfo(), it 
uses fp->bpf_func as the base address to resolve the final instruction 
pointers:

kernel/bpf/core.c:bpf_prog_fill_jited_linfo() {
    ...
    for (i = 1; i < nr_linfo && linfo[i].insn_off < insn_end; i++)
        jited_linfo[i] = prog->bpf_func +
            insn_to_jit_off[linfo[i].insn_off - insn_start - 1];
}

Since fp->bpf_func has already been shifted forward by cfi_get_offset(), 
adding the unadjusted jit.addrs offsets might shift the resulting line info 
by 4 bytes, which could break source line mapping in userspace tools.

Should jit.addrs be adjusted to subtract cfi_get_offset() before filling 
the line info, or should the original base pointer be passed instead?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724141318.1037434-1-hca@linux.ibm.com?part=6