On Sun, Aug 09, 2026 at 10:30:35AM -0700, Kees Cook wrote:
> On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote:
> > Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
> > misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
> > by enabling constant blinding for JITted BPF code from unprivileged
> > users.
> >
> > Signed-off-by: Jennifer Miller <[email protected]>
> > ---
> > kernel/bpf/core.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > index 47fe047ad30b..ed22b90c6e4e 100644
> > --- a/kernel/bpf/core.c
> > +++ b/kernel/bpf/core.c
> > @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
> > /* All BPF JIT sysctl knobs here. */
> > int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
> > int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
> > -int bpf_jit_harden __read_mostly;
> > +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI
> > + * hashes and endbr64 instructions from being crafted.
> > + */
> > +int bpf_jit_harden __read_mostly = IS_ENABLED(CONFIG_X86_64) &&
> > + IS_ENABLED(CONFIG_CFI);
>
> Why not just do this for all CONFIG_CFI?
Additionally; does it make sense to add an arch hook to
bpf_jit_blind_constant() / bpg_jit_blind_insn() such that architectures
can blacklist certain values?
Because as is, the whole thing *can* still generate an ENBBR by sheer
accident.
I'm thinking something simple like:
while (imm_rnd ^ imm == gen_endbr() || imm_rnd == gen_endbr())
imm_rnd = get_random_u32();
should do.
