Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled

On Sun, Aug 09, 2026 at 10:30:35AM -0700, Kees Cook wrote:
> On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote:
> > Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
> > misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
> > by enabling constant blinding for JITted BPF code from unprivileged
> > users.
> > 
> > Signed-off-by: Jennifer Miller <[email protected]>
> > ---
> >  kernel/bpf/core.c | 6 +++++-
> >  1 file changed, 5 insertions(+), 1 deletion(-)
> > 
> > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > index 47fe047ad30b..ed22b90c6e4e 100644
> > --- a/kernel/bpf/core.c
> > +++ b/kernel/bpf/core.c
> > @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
> >  /* All BPF JIT sysctl knobs here. */
> >  int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
> >  int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
> > -int bpf_jit_harden   __read_mostly;
> > +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI
> > + * hashes and endbr64 instructions from being crafted.
> > + */
> > +int bpf_jit_harden   __read_mostly = IS_ENABLED(CONFIG_X86_64) &&
> > +					IS_ENABLED(CONFIG_CFI);
> 
> Why not just do this for all CONFIG_CFI?
> 
> -Kees
> 

The intention was to not enable JIT hardening by default for other
architectures when CONFIG_CFI is enabled when we don't know if it would
be preventing any CFI from being bypassed. It may be possible that kCFI
on other architectures is able to be bypassed in similar ways to x86_64,
but we haven't looked into it.

~Jennifer

> >  long bpf_jit_limit   __read_mostly;
> >  long bpf_jit_limit_max __read_mostly;
> >  
> > -- 
> > 2.34.1
> > 
> 
> -- 
> Kees Cook