loongarch TailCall Lockup

Vulnerability analysis

The LoongArch BPF JIT compiler calculates tail-call branch offsets using a macro that derives the jump distance from a stale code stride saved during a prior JIT pass. When the compiler performs extra passes, this stale value produces wrong branch offsets, and the generated native code jumps to incorrect locations—typically creating backward loops that hang the CPU indefinitely. The fix replaces the macro-based calculation with a direct computation from the absolute target instruction index minus the current emit position, ensuring the offset is always correct regardless of which pass is running. A guard is also added so that during the size-estimation pass (when no JIT image buffer exists yet) a safe dummy offset of zero is used, preventing a false range-check failure. The vulnerable code path is reachable by any local user who can load a BPF program with tail calls on a LoongArch system, which requires CAP_BPF or equivalent privileges.