Re: [RFC PATCH bpf-next v1 1/1] bpf: Enable JIT hardening by default when x86_64 CFI is enabled

[bot+bpf-ci]

> bpf: Enable JIT hardening by default when x86_64 CFI is enabled
>
>     Initializes bpf_jit_harden to 1 if x86_64 CFI is enabled. Prevents the
>     misuse of BPF JIT code to craft CFI signatures or Endbr64 instructions
>     by enabling constant blinding for JITted BPF code from unprivileged
>     users.
>
>     Signed-off-by: Jennifer Miller <jmill@xxxxxxx>

This closes a hardening gap that only exists once x86_64 can enable CFI,
which came in with the x86_64 CFI support that added
'select ARCH_SUPPORTS_CFI_CLANG if X86_64'.  Should this carry a Fixes:
tag pointing at that commit, for example:

  Fixes: 3c516f89e17e ("x86: Add support for CONFIG_CFI_CLANG")


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/29118478293