[PATCH bpf] bpf, arm64: Fix jited line info off by kCFI hash

[Jose Fernandez (Anthropic)]

With CONFIG_CFI=y, the jited line info of every arm64 BPF program is
off by one instruction, so tools that use it show the wrong source line.

The JIT counts ctx.offset[] from ctx.ro_image. Since commit
710618c760c0 ("arm64/cfi,bpf: Support kCFI + BPF on arm64"),
prog->bpf_func starts past the 4-byte kCFI hash, and
bpf_prog_fill_jited_linfo() adds the offsets to prog->bpf_func.

Subtract cfi_get_offset() from the offsets before the fill, and move
the fill after bpf_prog_update_insn_ptrs(), which needs the offsets
relative to ctx.ro_image.

Fixes: 710618c760c0 ("arm64/cfi,bpf: Support kCFI + BPF on arm64")
Reported-by: Sashiko <sashiko-bot@xxxxxxxxxx>
Closes: https://lore.kernel.org/all/20260904014748.C04AA1F000E9@xxxxxxxxxxxxxxx/
Reported-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Closes: https://lore.kernel.org/all/DLNXZ2WK7TPD.2RZBUNRS4FA4L@xxxxxxxxx/
Assisted-by: LLM
Signed-off-by: Jose Fernandez (Anthropic) <jose.fernandez@xxxxxxxxx>
---
Tested in an arm64 KVM guest with CONFIG_CFI=y. Without this patch
every line info entry after a function's first was off by one
instruction, and with it every entry was correct.
---
 arch/arm64/net/bpf_jit_comp.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c
index c5f55d6161fee..cdc98efc1acf0 100644
--- a/arch/arm64/net/bpf_jit_comp.c
+++ b/arch/arm64/net/bpf_jit_comp.c
@@ -2345,14 +2345,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_verifier_env *env, struct bpf_pr
 		/* offset[prog->len] is the size of program */
 		for (i = 0; i <= prog->len; i++)
 			ctx.offset[i] *= AARCH64_INSN_SIZE;
-		bpf_prog_fill_jited_linfo(prog, ctx.offset + 1);
 		/*
 		 * The bpf_prog_update_insn_ptrs function expects offsets to
 		 * point to the first byte of the jitted instruction (unlike
-		 * the bpf_prog_fill_jited_linfo above, which, for historical
+		 * the bpf_prog_fill_jited_linfo below, which, for historical
 		 * reasons, expects to point to the next instruction)
 		 */
 		bpf_prog_update_insn_ptrs(prog, ctx.offset, ctx.ro_image);
+		/*
+		 * Line info is relative to prog->bpf_func, which starts
+		 * cfi_get_offset() bytes into ro_image. Shift the offsets here,
+		 * after bpf_prog_update_insn_ptrs(), which needs them unshifted.
+		 */
+		for (i = 0; i <= prog->len; i++)
+			ctx.offset[i] -= cfi_get_offset();
+		bpf_prog_fill_jited_linfo(prog, ctx.offset + 1);
 out_off:
 		if (!ro_header && priv_stack_ptr) {
 			free_percpu(priv_stack_ptr);

---
base-commit: ad139384ecddb6f3e7e3c3c12765aafae0e39670
change-id: 20260925-b4-arm64-bpf-linfo-cfi-f5c3897e408c

Best regards,
--  
Jose Fernandez (Anthropic) <jose.fernandez@xxxxxxxxx>