[PATCH 6.16.y 0/6] cBPF JIT spray hardening
From: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Date: 2026-07-14 18:58:25
Also in:
bpf, linux-arm-kernel, linux-riscv, loongarch, stable
Hi, These backports harden BPF JIT against spectre-v2 class of attacks. Without a predictor flush, execution of new BPF program may use stale prediction left behind by the freed one. To avoid this, issue an IBPB flush on all CPUs on JIT program allocation. The flush is conditional to spectre-v2 mitigation applied. Patch 1-2: Adds the predictor flush hook and enables it on x86 via IBPB. bpf: Support for hardening against JIT spraying x86/bugs: Enable IBPB flush on BPF JIT allocation Patch 3-6: Narrow the flush to only unprivileged JIT allocations to avoid redundant flushes. Also adds pack-selection changes that minimizes flushes. bpf: Restrict JIT predictor flush to cBPF bpf: Skip redundant IBPB in pack allocator bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Prefer dirty packs for eBPF allocations This one is mostly similar to 6.18: https://lore.kernel.org/all/20260713-cbpf-jit-spray-hardening-6-18-y-v1-0-755f60c55705@linux.intel.com/ (local) --- Pawan Gupta (6): bpf: Support for hardening against JIT spraying x86/bugs: Enable IBPB flush on BPF JIT allocation bpf: Restrict JIT predictor flush to cBPF bpf: Skip redundant IBPB in pack allocator bpf: Prefer packs that won't trigger an IBPB flush on allocation bpf: Prefer dirty packs for eBPF allocations arch/arm64/net/bpf_jit_comp.c | 4 +-- arch/powerpc/net/bpf_jit_comp.c | 4 +-- arch/riscv/net/bpf_jit_comp64.c | 2 +- arch/riscv/net/bpf_jit_core.c | 3 +- arch/x86/include/asm/nospec-branch.h | 4 +++ arch/x86/kernel/cpu/bugs.c | 50 +++++++++++++++++++++++--- arch/x86/net/bpf_jit_comp.c | 5 +-- include/linux/filter.h | 15 ++++++-- kernel/bpf/core.c | 68 ++++++++++++++++++++++++++++++++---- kernel/bpf/dispatcher.c | 2 +- 10 files changed, 135 insertions(+), 22 deletions(-) --- base-commit: d997d33eb340e2add100eac1222e107cc1396e76 change-id: 20260714-cbpf-jit-spray-hardening-6-16-y-5c50449f820c Best regards, -- Pawan