From: Pu Lehui When CFI is enabled, the actual BPF program entry point is shifted forward by a CFI preamble. During bpf_jit_free(), this shifted pointer causes the wrong ro_header to be fetched, leading to a potential invalid memory free. Fix this by subtracting cfi_get_offset() from prog->bpf_func to correctly restore the original JITed allocation address before freeing. Fixes: e63985ecd226 ("bpf, riscv64/cfi: Support kCFI + BPF on riscv64") Signed-off-by: Pu Lehui --- arch/riscv/net/bpf_jit_core.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/riscv/net/bpf_jit_core.c b/arch/riscv/net/bpf_jit_core.c index cbfcd287ea16..059db1adeaf8 100644 --- a/arch/riscv/net/bpf_jit_core.c +++ b/arch/riscv/net/bpf_jit_core.c @@ -237,6 +237,7 @@ void bpf_jit_free(struct bpf_prog *prog) kvfree(jit_data->ctx.offset); kfree(jit_data); } + prog->bpf_func = (void *)prog->bpf_func - cfi_get_offset(); hdr = bpf_jit_binary_pack_hdr(prog); bpf_jit_binary_pack_free(hdr, NULL); WARN_ON_ONCE(!bpf_prog_kallsyms_verify_off(prog)); -- 2.34.1