Re: [PATCH 6.18.y 2/6] x86/bugs: Enable IBPB flush on BPF JIT allocation

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] BPF JIT allocations trigger a system-wide IPI broadcast for IBPB flushing, allowing an attacker to cause a severe local Denial of Service (DoS) by spamming BPF program loads.
--

--- Patch [2]: [PATCH 6.18.y 2/6] x86/bugs: Enable IBPB flush on BPF JIT allocation ---
commit 6fe177facacbbf6baebd63b419b7a3255bc1668f
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>

x86/bugs: Enable IBPB flush on BPF JIT allocation

This commit enables an IBPB flush on BPF JIT memory reuse to mitigate
Spectre-v2 JIT spraying attacks. It adds bpf_arch_ibpb() to broadcast the
required MSR write system-wide when BPF JIT is active.

> diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
> index d7fa03bf51b45..fd0b7880cf7e5 100644
> --- a/arch/x86/kernel/cpu/bugs.c
> +++ b/arch/x86/kernel/cpu/bugs.c
[ ... ]
> @@ -2383,6 +2396,27 @@ static void __init spectre_v2_update_mitigation(void)
>  		pr_info("%s\n", spectre_v2_strings[spectre_v2_enabled]);
>  }
>  
> +#ifdef CONFIG_BPF_JIT
> +static void __bpf_arch_ibpb(void *unused)
> +{
> +	write_ibpb();
> +}
> +
> +void bpf_arch_ibpb(void)
> +{
> +	on_each_cpu(__bpf_arch_ibpb, NULL, 1);
> +}

[Severity: High]
Does this introduce a potential local denial of service vector?

During BPF JIT compilation, bpf_prog_pack_alloc() invokes the predictor
flush unconditionally:

kernel/bpf/core.c:bpf_prog_pack_alloc() {
    ...
found_free_area:
	static_call_cond(bpf_arch_pred_flush)();
    ...
}

Since this results in calling bpf_arch_ibpb() which uses on_each_cpu() with
wait=1, won't this trigger a synchronous system-wide IPI broadcast on every
BPF program load?

If a user spams BPF program loads or unloads in a tight loop, could this
create an IPI storm that starves other tasks and locks up the system?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260713-cbpf-jit-spray-hardening-6-18-y-v1-0-755f60c55705@linux.intel.com?part=2