Re: [PATCH 7.1.y 0/6] cBPF JIT spray hardening

[PATCH 7.1.y 0/6] cBPF JIT spray hardening · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
[PATCH 7.1.y 1/6] bpf: Support for hardening against JIT spraying · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
Re: [PATCH 7.1.y 1/6] bpf: Support for hardening against JIT spraying · bot+bpf-ci@kernel.org · 2026-07-09
[PATCH 7.1.y 2/6] x86/bugs: Enable IBPB flush on BPF JIT allocation · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
[PATCH 7.1.y 3/6] bpf: Restrict JIT predictor flush to cBPF · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
[PATCH 7.1.y 4/6] bpf: Skip redundant IBPB in pack allocator · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
[PATCH 7.1.y 5/6] bpf: Prefer packs that won't trigger an IBPB flush on allocation · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
[PATCH 7.1.y 6/6] bpf: Prefer dirty packs for eBPF allocations · Pawan Gupta <pawan.kumar.gupta@linux.intel.com> · 2026-07-09
Re: [PATCH 7.1.y 0/6] cBPF JIT spray hardening · Sasha Levin <sashal@kernel.org> · 2026-07-10

From: Sasha Levin <sashal@kernel.org>
Date: 2026-07-10 21:03:35
Also in: bpf, linux-arm-kernel, linux-riscv, loongarch, stable

On Thu, Jul 09, 2026 at 03:22:54PM -0700, Pawan Gupta wrote:

These backports harden BPF JIT against spectre-v2 class of attacks. Without
a predictor flush, execution of new BPF program may use stale prediction
left behind by the freed one.

To avoid this, issue an IBPB flush on all CPUs on JIT program allocation.
The flush is conditional to spectre-v2 mitigation applied.

Queued the series for 7.1, thanks.

-- 
Thanks,
Sasha

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help