On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote: > Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the > misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions > by enabling constant blinding for JITted BPF code from unprivileged > users. > > Signed-off-by: Jennifer Miller <[email protected]> > --- > kernel/bpf/core.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c > index 47fe047ad30b..ed22b90c6e4e 100644 > --- a/kernel/bpf/core.c > +++ b/kernel/bpf/core.c > @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp) > /* All BPF JIT sysctl knobs here. */ > int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); > int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); > -int bpf_jit_harden __read_mostly; > +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI > + * hashes and endbr64 instructions from being crafted. > + */ > +int bpf_jit_harden __read_mostly = IS_ENABLED(CONFIG_X86_64) && > + IS_ENABLED(CONFIG_CFI);
Why not just do this for all CONFIG_CFI? -Kees > long bpf_jit_limit __read_mostly; > long bpf_jit_limit_max __read_mostly; > > -- > 2.34.1 > -- Kees Cook
