CVE-2025-37893

LoongArch: BPF: Fix off-by-one error in build_prologue()

Medium · published April 18, 2025

CVSS v3.1
5.5
EPSS
0%
Percentile
19.4
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

LoongArch: BPF: Fix off-by-one error in build_prologue()

Vincent reported that running BPF progs with tailcalls on LoongArch

causes kernel hard lockup. Debugging the issues shows that the JITed

image missing a jirl instruction at the end of the epilogue.

There are two passes in JIT compiling, the first pass set the flags and

the second pass generates JIT code based on those flags. With BPF progs

mixing bpf2bpf and tailcalls, build_prologue() generates N insns in the

first pass and then generates N+1 insns in the second pass. This makes

epilogue_offset off by one and we will jump to some unexpected insn and

cause lockup. Fix this by inserting a nop insn.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.4th percentile
Published
2025-04-18T07:01Z
EPSS history
Timeline
  • 18 APR 07:01Z
    LoongArch: BPF: Fix off-by-one error in build_prologue()
    cvelistv5