> bpf: Enable JIT hardening by default when x86_64 CFI is enabled
>
> Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
> misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
> by enabling constant blinding for JITted BPF code from unprivileged
> users.
>
> Signed-off-by: Jennifer Miller <[email protected]>
This closes a hardening gap that only exists once x86_64 can enable CFI,
which came in with the x86_64 CFI support that added
'select ARCH_SUPPORTS_CFI_CLANG if X86_64'. Should this carry a Fixes:
tag pointing at that commit, for example:
Fixes: 3c516f89e17e ("x86: Add support for CONFIG_CFI_CLANG")
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29118478293
