Re: [PATCH 6.18.y 1/6] bpf: Support for hardening against JIT spraying

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] BPF programs larger than BPF_PROG_PACK_SIZE bypass the new predictor flush during allocation, leaving large privileged programs vulnerable to Spectre v2 JIT spraying.
--

--- Patch [1]: [PATCH 6.18.y 1/6] bpf: Support for hardening against JIT spraying ---
commit cb1a8f614dfc8fdb1bb7a2e56154f4f8e2cb7a53
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>

bpf: Support for hardening against JIT spraying

This commit introduces a mechanism to flush indirect branch predictors before
reusing JIT memory. The goal is to ensure indirect jumps in a newly written
program don't reuse branch predictions left behind by an old program that
previously occupied the same space.

> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
[ ... ]
> @@ -923,6 +933,14 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
>  
>  	mutex_lock(&pack_mutex);
>  	if (size > BPF_PROG_PACK_SIZE) {
> +		/*
> +		 * Allocations larger than a pack get their own pages, and
> +		 * predictors are not flushed for such allocation. This is only
> +		 * safe because cBPF programs (the unprivileged attack surface)
> +		 * are bounded well below a pack size.
> +		 */
> +		if (static_branch_unlikely(&bpf_pred_flush_enabled))
> +			pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
>  		size = round_up(size, PAGE_SIZE);
>  		ptr = bpf_jit_alloc_exec(size);

[Severity: High]
This isn't a bug introduced by this patch, but does this logic leave large
privileged eBPF programs vulnerable to Spectre v2 attacks?

The comment here justifies skipping the flush by stating that cBPF programs
(the unprivileged attack surface) are bounded well below a pack size. However,
in a Spectre v2 attack, the newly allocated program is actually the victim,
not the attacker.

If an unprivileged attacker loads and frees a small cBPF program to mistrain
the CPU branch predictors, and a privileged user subsequently loads a large
eBPF program (> BPF_PROG_PACK_SIZE), bpf_prog_pack_alloc() allocates it via
bpf_jit_alloc_exec().

If it reuses the same virtual memory, it explicitly bypasses the new
bpf_arch_pred_flush() call, forcing the privileged eBPF program to execute
using the attacker's leftover mistrained branch predictions.

Could large allocations also receive a predictor flush to ensure privileged
programs are protected?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-cbpf-jit-spray-hardening-6-18-y-v1-0-755f60c55705@linux.intel.com?part=1