From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32AC04B049B for ; Mon, 17 Aug 2026 13:24:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786973092; cv=none; b=Uf4uHoOueF0RvG6AaTzGrtL+YPFZy9i49x+zD3CFe0D3AxT7Z/1JjCcWjMbQd3lS+e9sOTdpk46o0Fp96MMQCEG7d4JSC/Fd+BXh6YjG247NKIVj4xwPGhPVwXo2eDVKr0U2nbGpW6uVJlfWOVkkUUK5HFVx78zfHf6EDmowiNs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786973092; c=relaxed/simple; bh=Hw/jfXcPPMobBLBI8W1VNi7tiStnZDpg9z6Ju3cQlQw=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=jj1VuIV109zgBLM1AmXmoYabsmvJ37EOEBw6Qk9sid53BWxisygRkcTxgCES3ZnVunl1lUjph8qATNPoOVHwo/5RTXNREubqjgqnJEGUpo1zPVtvL78gfZR1rlU27Fvzh7fEtJMCOEgT42pH+Wo2hipuMgXNR1L3gYjfSEuPRXg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu; spf=pass smtp.mailfrom=asu.edu; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b=Vr+7rqUS; arc=none smtp.client-ip=209.85.128.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=asu.edu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=asu.edu Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=asu.edu header.i=@asu.edu header.b="Vr+7rqUS" Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-49954b88fffso38633425e9.0 for ; Mon, 17 Aug 2026 06:24:49 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=asu.edu; s=google; t=1786973088; x=1787577888; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=oBxqkvt2QiyULLxw2yg2sHAVvNGWnYOoHvbaWXtRPBA=; b=Vr+7rqUSSmJQlcFh13E5PEUcs5NjpEBKr1CbNuCsbKC4C8uXbCU1uU/vxfKju1teOs jYGjkaMMapiV2Ag1e3hWftj3u5VTC4qrYkr4XyGS5qQVqK+o1a8GmZ54J9Rc3j8wyOki EWWPHSYwh5EWtxEl+k0XVg22Dz+3a8F/8JLASx4ox+loy/THofG/OjeOThDkzr30H6+/ JVQWJs/noLpZ/sdk8odXwzlkO/cc+VJw04xPYbcMaoUzN5a7fcEfnAFckjfmY701GS/a LAB8BoCmE0Q+mgJGQGNCIzbSv16raXt3dmojRPlz/Ky1FYeZ1+0r2lIpJfcbPrM9QAPq YNmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786973088; x=1787577888; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=oBxqkvt2QiyULLxw2yg2sHAVvNGWnYOoHvbaWXtRPBA=; b=MuC3e16zPiTW7h38k3OfpqpTsFCBsrEm0dJnCDA2zBIlqA4/TulP5retHKrgsK4zXG DLMuoubReRGkZ/nZYpja+A4LCHTsmFTHJGRJUjZ5dFl76oP9Srw4tT//+mhbUfJ3A/cr YTpEShEsVqPTMhCMUNKaMsMD2FzOymD8GZJhDApxLKnhQ8ucDmENZXy6Hz95iiWg3lkh s3TZ+wwJjvM+ZmfGSdynXshstI8PDgbaPTxLVFC/EgqnsPeOTgHtGfoo8VbnDpJY/70w BL18W0D2mHGFguGMljCwkvjUapZUoopaPqC0wLxDjKYw2jAh1ZCMwuS5TjO0XIOQpy+V +gSA== X-Forwarded-Encrypted: i=1; AHgh+RqY4KJVPRPRZUHfWnNstSb0Kif27XD/p0PWB0XdD69fz0K/0aJce7EZo7qkpAD8P7DUXxvQ8LSjBpVK9Ys=@vger.kernel.org X-Gm-Message-State: AOJu0YxTXAbMfmRywM8ghvvRGhI2ayrFF5ygIauPcM828kMI28ELAZmo xuPsCBbM0EMeF1cCrOliz3wB9bzBCCG/OzMCP0lwbhzKDZYe1cza8AR/biuO7yqgRw== X-Gm-Gg: AR+sD138M7hwDl61X2JxP8hs9pg1XR8GSjs92/51lqdG6+tLDvsaMgUxxl8RxjbK00b GTtIAIQsX+hzizw+znec+LqJIUv9JafG7ONN9QxTXcnHMV4U0UNrODD/QTfTuFB80M53mitpGCH Fsd3bSQbCz8MFumVxMXuoKfLNAxHqGXGpgA6hat7tVJLv/HIHaY1AVrd/xpktYZvKv8mpmxAdHE +bERq3kk5wdNoPyJRPbGPADu8urW/5F068I9CaLsFF2UmJvcWI5Cu4Y5wdMEEULoiijA+2Mbvdm Ox110JOxEZ9kHgYlTo6K12U904FdnEmWyyzWJdXMxSh15tz4NWOiSaU/XHd8+DeleXpW4WeDUC8 FrZWD4fjoxUp+fsuPTul2HXwqlaH5MJMmHjOqrBFD4b9/wHe0je+OpPhPwKU6nbHimgHhJVj+M7 DHeEdw/wLpFBaGzq92hzwVsE/b0i7fEdNcDHhU+c3D5AiQNz7ZIZUsgVUcnTiYYJzdMXJpXKU= X-Received: by 2002:a05:600c:3b1d:b0:499:87b6:f3c0 with SMTP id 5b1f17b1804b1-4998807e4c9mr382618245e9.14.1786973087942; Mon, 17 Aug 2026 06:24:47 -0700 (PDT) Received: from spiro ([141.5.46.6]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49996109652sm188597975e9.4.2026.08.17.06.24.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 17 Aug 2026 06:24:47 -0700 (PDT) Date: Mon, 17 Aug 2026 06:24:44 -0700 From: Jennifer Miller To: Kees Cook Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com, memxor@gmail.com, linux-hardening@vger.kernel.org, xmei5@asu.edu, samitolvanen@google.com, peterz@infradead.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled Message-ID: References: <20260710191932.120911-1-jmill@asu.edu> <20260710191932.120911-2-jmill@asu.edu> <202608091030.C69278022@keescook> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <202608091030.C69278022@keescook> On Sun, Aug 09, 2026 at 10:30:35AM -0700, Kees Cook wrote: > On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote: > > Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the > > misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions > > by enabling constant blinding for JITted BPF code from unprivileged > > users. > > > > Signed-off-by: Jennifer Miller > > --- > > kernel/bpf/core.c | 6 +++++- > > 1 file changed, 5 insertions(+), 1 deletion(-) > > > > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c > > index 47fe047ad30b..ed22b90c6e4e 100644 > > --- a/kernel/bpf/core.c > > +++ b/kernel/bpf/core.c > > @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp) > > /* All BPF JIT sysctl knobs here. */ > > int bpf_jit_enable __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); > > int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON); > > -int bpf_jit_harden __read_mostly; > > +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI > > + * hashes and endbr64 instructions from being crafted. > > + */ > > +int bpf_jit_harden __read_mostly = IS_ENABLED(CONFIG_X86_64) && > > + IS_ENABLED(CONFIG_CFI); > > Why not just do this for all CONFIG_CFI? > > -Kees > The intention was to not enable JIT hardening by default for other architectures when CONFIG_CFI is enabled when we don't know if it would be preventing any CFI from being bypassed. It may be possible that kCFI on other architectures is able to be bypassed in similar ways to x86_64, but we haven't looked into it. ~Jennifer > > long bpf_jit_limit __read_mostly; > > long bpf_jit_limit_max __read_mostly; > > > > -- > > 2.34.1 > > > > -- > Kees Cook