Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled

[Kees Cook <kees@kernel.org>]

On Fri, Jul 10, 2026 at 12:19:32PM -0700, Jennifer Miller wrote:
> Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
> misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
> by enabling constant blinding for JITted BPF code from unprivileged
> users.
> 
> Signed-off-by: Jennifer Miller <jmill@asu.edu>
> ---
>  kernel/bpf/core.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 47fe047ad30b..ed22b90c6e4e 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -548,7 +548,11 @@ void bpf_prog_kallsyms_del_all(struct bpf_prog *fp)
>  /* All BPF JIT sysctl knobs here. */
>  int bpf_jit_enable   __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
>  int bpf_jit_kallsyms __read_mostly = IS_BUILTIN(CONFIG_BPF_JIT_DEFAULT_ON);
> -int bpf_jit_harden   __read_mostly;
> +/* Enable hardening by default when x86_64 CFI is enabled to prevent CFI
> + * hashes and endbr64 instructions from being crafted.
> + */
> +int bpf_jit_harden   __read_mostly = IS_ENABLED(CONFIG_X86_64) &&
> +					IS_ENABLED(CONFIG_CFI);

Why not just do this for all CONFIG_CFI?

-Kees

>  long bpf_jit_limit   __read_mostly;
>  long bpf_jit_limit_max __read_mostly;
>  
> -- 
> 2.34.1
> 

-- 
Kees Cook