Re: [PATCH bpf-next v5 03/10] bpf: add BPF_JIT_KASAN for KASAN instrumentation of JITed programs

[Ihor Solodrai]

On 7/9/26 3:01 AM, Alexis Lothoré (eBPF Foundation) wrote:
> Add a new Kconfig option CONFIG_BPF_JIT_KASAN that automatically enables
> generic KASAN (Kernel Address SANitizer) memory access checks for
> JIT-compiled BPF programs as well, when both KASAN (and more
> specifically, generic KASAN with KASAN_VMALLOC) and JIT compiler are
> enabled.

An auto-selected flag makes sense to me.

Acked-by: Ihor Solodrai <ihor.solodrai@xxxxxxxxx>

Two nits below.

> ... This new Kconfig is not a user selectable one: it is either
> automatically enabled if KASAN is enabled on a compatible platform. When

nit: dangling "either"

> enabled, the JIT compiler will emit shadow memory checks before memory
> loads and stores to detect use-after-free or out-of-bounds accesses at
> runtime. The option is gated behind HAVE_EBPF_JIT_KASAN, as it needs
> proper arch-specific implementation.
> 
> Signed-off-by: Alexis Lothoré (eBPF Foundation) <alexis.lothore@xxxxxxxxxxx>
> ---
> Changes in v4:
> - reorganize dependencies (Andrey)
> - drop VMAP_STACK dependency
> 
> Changes in v2:
> - add dependency on kasan for vmalloc and vmalloc'ed stack
> ---
>  kernel/bpf/Kconfig | 17 +++++++++++++++++
>  1 file changed, 17 insertions(+)
> 
> diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
> index eb3de35734f0..e1f3850d2f5a 100644
> --- a/kernel/bpf/Kconfig
> +++ b/kernel/bpf/Kconfig
> @@ -17,6 +17,10 @@ config HAVE_CBPF_JIT
>  config HAVE_EBPF_JIT
>  	bool
>  
> +# KASAN support for JIT compiler
> +config HAVE_EBPF_JIT_KASAN
> +	bool
> +
>  # Used by archs to tell that they want the BPF JIT compiler enabled by
>  # default for kernels that were compiled with BPF JIT support.
>  config ARCH_WANT_DEFAULT_BPF_JIT
> @@ -101,4 +105,17 @@ config BPF_LSM
>  
>  	  If you are unsure how to answer this question, answer N.
>  
> +config BPF_JIT_KASAN
> +	bool
> +	depends on HAVE_EBPF_JIT_KASAN
> +	depends on KASAN_GENERIC
> +	depends on KASAN_VMALLOC
> +	depends on BPF_JIT
> +	default y if KASAN

nit: KASAN_GENERIC already implies KASAN, so "if KASAN" is always true
when this symbol is visible, should be safe to drop.

> +	help
> +	  Makes JIT compiler insert generic outline KASAN checks in BPF
> +	  programs when they are inserted in the kernel. This feature is
> +	  automatically enabled if the needed set of KASAN and BPF
> +	  configuration options is enabled.
> +
>  endmenu # "BPF subsystem"
>