On Wed, Jul 8, 2026 at 10:02 AM Alexis Lothoré (eBPF Foundation) <[email protected]> wrote: > > Add a new Kconfig option CONFIG_BPF_JIT_KASAN that automatically enables > generic KASAN (Kernel Address SANitizer) memory access checks for > JIT-compiled BPF programs as well, when both KASAN (and more > specifically, generic KASAN with KASAN_VMALLOC) and JIT compiler are > enabled. This new Kconfig is not a user selectable one: it is either > automatically enabled if KASAN is enabled on a compatible platform. When > enabled, the JIT compiler will emit shadow memory checks before memory > loads and stores to detect use-after-free or out-of-bounds accesses at > runtime. The option is gated behind HAVE_EBPF_JIT_KASAN, as it needs > proper arch-specific implementation. > > Signed-off-by: Alexis Lothoré (eBPF Foundation) <[email protected]> > --- > Changes in v4: > - reorganize dependencies (Andrey) > - drop VMAP_STACK dependency > > Changes in v2: > - add dependency on kasan for vmalloc and vmalloc'ed stack > --- > kernel/bpf/Kconfig | 17 +++++++++++++++++ > 1 file changed, 17 insertions(+) > > diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig > index eb3de35734f0..e1f3850d2f5a 100644 > --- a/kernel/bpf/Kconfig > +++ b/kernel/bpf/Kconfig > @@ -17,6 +17,10 @@ config HAVE_CBPF_JIT > config HAVE_EBPF_JIT > bool > > +# KASAN support for JIT compiler > +config HAVE_EBPF_JIT_KASAN > + bool > + > # Used by archs to tell that they want the BPF JIT compiler enabled by > # default for kernels that were compiled with BPF JIT support. > config ARCH_WANT_DEFAULT_BPF_JIT > @@ -101,4 +105,17 @@ config BPF_LSM > > If you are unsure how to answer this question, answer N. > > +config BPF_JIT_KASAN > + bool > + depends on HAVE_EBPF_JIT_KASAN > + depends on KASAN_GENERIC > + depends on KASAN_VMALLOC > + depends on BPF_JIT > + default y if KASAN > + help > + Makes JIT compiler insert generic outline KASAN checks in BPF > + programs when they are inserted in the kernel. This feature is > + automatically enabled if the needed set of KASAN and BPF > + configuration options is enabled. > + > endmenu # "BPF subsystem" > > -- > 2.54.0 >
Acked-by: Andrey Konovalov <[email protected]> Thanks!
