Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled
| Newsgroups | org.kernel.vger.linux-hardening,org.kernel.vger.bpf,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <2d2f91cf7808493a8019b3beee814817421876d6a8602eba0a0f990823b16544@mail.kernel.org> |
> bpf: Enable JIT hardening by default when x86_64 CFI is enabled > > Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the > misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions > by enabling constant blinding for JITted BPF code from unprivileged > users. > > Signed-off-by: Jennifer Miller <[email protected]> This closes a hardening gap that only exists once x86_64 can enable CFI, which came in with the x86_64 CFI support that added 'select ARCH_SUPPORTS_CFI_CLANG if X86_64'. Should this carry a Fixes: tag pointing at that commit, for example: Fixes: 3c516f89e17e ("x86: Add support for CONFIG_CFI_CLANG") --- AI reviewed your patch. Please fix the bug or email reply why it's not a bug. See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29118478293