Re: [PATCH 6.16.y 1/6] bpf: Support for hardening against JIT spraying

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The branch predictor flush is bypassed for BPF allocations larger than BPF_PROG_PACK_SIZE, leaving privileged BPF programs vulnerable to Branch Target Injection (BTI) / Spectre v2 attacks. The author's rationale for skipping the flush assumes attackers cannot allocate large programs. However, an attacker can train the BTB using small programs and free them; a victim's subsequent large allocation can reuse the same virtual memory and will skip the flush, inheriting the poisoned BTB entries. Additionally, on configurations where PMD_SIZE is undefined, BPF_PROG_PACK_SIZE defaults to PAGE_SIZE (typically 4KB), which unprivileged cBPF programs (up to 32KB) can exceed, directly bypassing the flush.
--

--- Patch [1]: [PATCH 6.16.y 1/6] bpf: Support for hardening against JIT spraying ---
commit 86ef6d6286895019e1dbe8a1db211825e4c28b04
Author: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>

bpf: Support for hardening against JIT spraying

This commit introduces a branch predictor flush before reusing BPF JIT memory.
It aims to prevent indirect jumps in a newly written program from reusing
predictions left behind by an old program that occupied the same space.

> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 17e5cf18da1ef..48208c3f58143 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c

[ ... ]

> @@ -951,6 +961,14 @@ void *bpf_prog_pack_alloc(u32 size, bpf_jit_fill_hole_t bpf_fill_ill_insns)
>  
>  	mutex_lock(&pack_mutex);
>  	if (size > BPF_PROG_PACK_SIZE) {
> +		/*
> +		 * Allocations larger than a pack get their own pages, and
> +		 * predictors are not flushed for such allocation. This is only
> +		 * safe because cBPF programs (the unprivileged attack surface)
> +		 * are bounded well below a pack size.
> +		 */
> +		if (static_branch_unlikely(&bpf_pred_flush_enabled))
> +			pr_warn_once("BPF: Predictors not flushed for allocations greater than BPF_PROG_PACK_SIZE\n");
>  		size = round_up(size, PAGE_SIZE);
>  		ptr = bpf_jit_alloc_exec(size);
>  		if (ptr) {

[Severity: High]
Does skipping the flush for large allocations leave them vulnerable to BTB
poisoning if the virtual memory is reused?

If an attacker trains the BTB using small programs and frees them, and then a
victim loads a large program that reuses the same virtual memory, wouldn't the
large allocation skip the flush and inherit the poisoned BTB entries?

Additionally, on configurations where PMD_SIZE is undefined,
BPF_PROG_PACK_SIZE defaults to PAGE_SIZE (typically 4KB). Could unprivileged
cBPF programs (which can be up to 32KB) exceed this and bypass the flush
directly?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260714-cbpf-jit-spray-hardening-6-16-y-v1-0-2fc3e16263ac@linux.intel.com?part=1