Re: [PATCH bpf-next v3 03/10] bpf: add BPF_JIT_KASAN for KASAN instrumentation of JITed programs

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] BPF_JIT_KASAN needlessly restricts its availability by unconditionally requiring VMAP_STACK.
--

commit 23714982e1ca6e827ba19b9f4c74b703b4ad2090
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf: add BPF_JIT_KASAN for KASAN instrumentation of JITed programs

This commit introduces CONFIG_BPF_JIT_KASAN to enable generic KASAN memory
access checks for JIT-compiled BPF programs. The JIT compiler emits shadow
memory checks before memory accesses to detect bugs like use-after-free or
out-of-bounds at runtime. The feature is gated behind HAVE_EBPF_JIT_KASAN.

> As KASAN instrumentation for eBPF program will depend on the info that
> can be accessed during each instruction verification, there may be
> instructions that will be instrumented even if they don't really need to
> (eg: global subprograms that access caller stack memory passed as
> argument). To make sure that those additional checks do not trigger any
> crash, make sure that VMAP_STACK is enabled so that programs stack has
> shadow memory allocated.

[Severity: Medium]
Does generic KASAN already map shadow memory for the entire linear mapping?
If VMAP_STACK is disabled, the kernel stack resides in the linear mapping,
which should already have shadow memory allocated. Could this justification
be slightly misunderstanding the default generic KASAN shadow memory coverage?

> diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
> --- a/kernel/bpf/Kconfig
> +++ b/kernel/bpf/Kconfig

[ ... ]

> @@ -101,4 +105,9 @@ config BPF_LSM
>  
>  	  If you are unsure how to answer this question, answer N.
>  
> +config BPF_JIT_KASAN
> +	bool
> +	depends on HAVE_EBPF_JIT_KASAN
> +	default y if BPF_JIT && KASAN_GENERIC && KASAN_VMALLOC && VMAP_STACK

[Severity: Medium]
Is it necessary to unconditionally require VMAP_STACK for BPF_JIT_KASAN?

Following up on the commit message note, since generic KASAN covers the
linear mapping where non-VMAP stacks reside, this condition might needlessly
disable a useful security and debugging feature on kernel configurations
where VMAP_STACK happens to be turned off.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260701-kasan-v3-0-bd09bb942d86@bootlin.com?part=3