On 8/17/2026 9:24 PM, Jennifer Miller wrote:
On Sun, Aug 09, 2026 at 10:30:35AM -0700, Kees Cook wrote:
On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote:
Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
by enabling constant blinding for JITted BPF code from unprivileged
users.
Signed-off-by: Jennifer Miller <[email protected]>
---
kernel/bpf/core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 47fe047ad30b..ed22b90c6e4e 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
/* All BPF JIT sysctl knobs here. */
int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
-int bpf_jit_harden __read_mostly;
+/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI
+ * hashes and endbr64 instructions from being crafted.
+ */
+int bpf_jit_harden __read_mostly = IS_ENABLED(CONFIG_X86_64) &&
+ IS_ENABLED(CONFIG_CFI);
Why not just do this for all CONFIG_CFI?
-Kees
The intention was to not enable JIT hardening by default for other
architectures when CONFIG_CFI is enabled when we don't know if it would
be preventing any CFI from being bypassed. It may be possible that kCFI
on other architectures is able to be bypassed in similar ways to x86_64,
but we haven't looked into it.
~Jennifer
Yeah, IIUC the described attacks rely heavily on x86-64's
variable-length instructions. On arm64, instructions are
strictly 4-byte aligned and jumping into the middle of an
instruction is not allowed, so the attacks seem not feasible,
at least in the current form.
long bpf_jit_limit __read_mostly;
long bpf_jit_limit_max __read_mostly;
--
2.34.1
--
Kees Cook
