Re: [PATCH RFC bpf-next 7/8] bpf, x86: enable KASAN for JITed programs on x86

sashiko-bot
2026-04-25T06:33:23Z

Sashiko AI review found 1 potential issue(s):
- [High] The x86 JIT compiler misses KASAN instrumentation for BPF_ST (store immediate to memory) and BPF_ATOMIC (atomic read-modify-write) instructions.
--

commit b74234d98543fb8b6b97cccfe13819f42ebebe33
Author: Alexis Lothoré (eBPF Foundation) <alexis.lothore@bootlin.com>

bpf, x86: enable KASAN for JITed programs on x86

Mark x86 as supporting KASAN checks in JITed programs so that the
corresponding JIT compiler inserts checks on the translated
instructions.

> diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
> index f3f7cb01d69d0..cc140108b74c5 100644
> --- a/arch/x86/Kconfig
> +++ b/arch/x86/Kconfig
> @@ -235,6 +235,7 @@ config X86
> select HAVE_SAMPLE_FTRACE_DIRECT if X86_64
> select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if X86_64
> select HAVE_EBPF_JIT
> + select HAVE_EBPF_JIT_KASAN if X86_64

Is it safe to enable KASAN for eBPF JIT on x86 when some memory access
instructions appear to be missing KASAN checks?

Looking at arch/x86/net/bpf_jit_comp.c, while BPF_LDX | BPF_MEM and
BPF_STX | BPF_MEM correctly call emit_kasan_check(), BPF_ST | BPF_MEM
and BPF_STX | BPF_ATOMIC directly emit x86 memory access instructions without
instrumentation.

For example, BPF_ST | BPF_MEM does not include the check:

arch/x86/net/bpf_jit_comp.c:do_jit() {
...
case BPF_ST | BPF_MEM | BPF_W:
if (is_ereg(dst_reg))
EMIT2(0x41, 0xC7);
else
EMIT1(0xC7);
goto st;
...
}

Similarly, atomic operations are missing the check:

arch/x86/net/bpf_jit_comp.c:do_jit() {
...
case BPF_STX | BPF_ATOMIC | BPF_W:
case BPF_STX | BPF_ATOMIC | BPF_DW:
if (insn->imm == (BPF_AND | BPF_FETCH) ||
...
}

Could this allow an eBPF program to bypass KASAN memory safety validation
by using immediate stores or atomic operations?

[ ... ]

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260413-kasan-v1-0-1a5831230821@bootlin.com?part=7