On 7/9/26 3:01 AM, Alexis Lothoré (eBPF Foundation) wrote: > Add a new Kconfig option CONFIG_BPF_JIT_KASAN that automatically enables > generic KASAN (Kernel Address SANitizer) memory access checks for > JIT-compiled BPF programs as well, when both KASAN (and more > specifically, generic KASAN with KASAN_VMALLOC) and JIT compiler are > enabled.
An auto-selected flag makes sense to me. Acked-by: Ihor Solodrai <[email protected]> Two nits below. > ... This new Kconfig is not a user selectable one: it is either > automatically enabled if KASAN is enabled on a compatible platform. When nit: dangling "either" > enabled, the JIT compiler will emit shadow memory checks before memory > loads and stores to detect use-after-free or out-of-bounds accesses at > runtime. The option is gated behind HAVE_EBPF_JIT_KASAN, as it needs > proper arch-specific implementation. > > Signed-off-by: Alexis Lothoré (eBPF Foundation) <[email protected]> > --- > Changes in v4: > - reorganize dependencies (Andrey) > - drop VMAP_STACK dependency > > Changes in v2: > - add dependency on kasan for vmalloc and vmalloc'ed stack > --- > kernel/bpf/Kconfig | 17 +++++++++++++++++ > 1 file changed, 17 insertions(+) > > diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig > index eb3de35734f0..e1f3850d2f5a 100644 > --- a/kernel/bpf/Kconfig > +++ b/kernel/bpf/Kconfig > @@ -17,6 +17,10 @@ config HAVE_CBPF_JIT > config HAVE_EBPF_JIT > bool > > +# KASAN support for JIT compiler > +config HAVE_EBPF_JIT_KASAN > + bool > + > # Used by archs to tell that they want the BPF JIT compiler enabled by > # default for kernels that were compiled with BPF JIT support. > config ARCH_WANT_DEFAULT_BPF_JIT > @@ -101,4 +105,17 @@ config BPF_LSM > > If you are unsure how to answer this question, answer N. > > +config BPF_JIT_KASAN > + bool > + depends on HAVE_EBPF_JIT_KASAN > + depends on KASAN_GENERIC > + depends on KASAN_VMALLOC > + depends on BPF_JIT > + default y if KASAN nit: KASAN_GENERIC already implies KASAN, so "if KASAN" is always true when this symbol is visible, should be safe to drop. > + help > + Makes JIT compiler insert generic outline KASAN checks in BPF > + programs when they are inserted in the kernel. This feature is > + automatically enabled if the needed set of KASAN and BPF > + configuration options is enabled. > + > endmenu # "BPF subsystem" >
