Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled

[email protected]
Newsgroups org.kernel.vger.linux-hardening,org.kernel.vger.bpf,org.kernel.vger.linux-kernel
Message-ID <2d2f91cf7808493a8019b3beee814817421876d6a8602eba0a0f990823b16544@mail.kernel.org>
> bpf: Enable JIT hardening by default when x86_64 CFI is enabled
>
>     Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
>     misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
>     by enabling constant blinding for JITted BPF code from unprivileged
>     users.
>
>     Signed-off-by: Jennifer Miller <[email protected]>

This closes a hardening gap that only exists once x86_64 can enable CFI,
which came in with the x86_64 CFI support that added
'select ARCH_SUPPORTS_CFI_CLANG if X86_64'.  Should this carry a Fixes:
tag pointing at that commit, for example:

  Fixes: 3c516f89e17e ("x86: Add support for CONFIG_CFI_CLANG")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29118478293
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.