Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled

On 8/17/2026 9:24 PM, Jennifer Miller wrote:
> On Sun, Aug 09, 2026 at 10:30:35AM -0700, Kees Cook wrote:
>> On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote:
>>> Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
>>> misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
>>> by enabling constant blinding for JITted BPF code from unprivileged
>>> users.
>>>
>>> Signed-off-by: Jennifer Miller <[email protected]>
>>> ---
>>>   kernel/bpf/core.c | 6 +++++-
>>>   1 file changed, 5 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
>>> index 47fe047ad30b..ed22b90c6e4e 100644
>>> --- a/kernel/bpf/core.c
>>> +++ b/kernel/bpf/core.c
>>> @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
>>>   /* All BPF JIT sysctl knobs here. */
>>>   int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
>>>   int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
>>> -int bpf_jit_harden   __read_mostly;
>>> +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI
>>> + * hashes and endbr64 instructions from being crafted.
>>> + */
>>> +int bpf_jit_harden   __read_mostly = IS_ENABLED(CONFIG_X86_64) &&
>>> +					IS_ENABLED(CONFIG_CFI);
>>
>> Why not just do this for all CONFIG_CFI?
>>
>> -Kees
>>
> 
> The intention was to not enable JIT hardening by default for other
> architectures when CONFIG_CFI is enabled when we don't know if it would
> be preventing any CFI from being bypassed. It may be possible that kCFI
> on other architectures is able to be bypassed in similar ways to x86_64,
> but we haven't looked into it.
> 
> ~Jennifer
>

Yeah, IIUC the described attacks rely heavily on x86-64's
variable-length instructions. On arm64, instructions are
strictly 4-byte aligned and jumping into the middle of an
instruction is not allowed, so the attacks seem not feasible,
at least in the current form.

>>>   long bpf_jit_limit   __read_mostly;
>>>   long bpf_jit_limit_max __read_mostly;
>>>   
>>> -- 
>>> 2.34.1
>>>
>>
>> -- 
>> Kees Cook
>