]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
bpf: Restrict JIT predictor flush to cBPF
authorPawan Gupta <pawan.kumar.gupta@linux.intel.com>
Tue, 30 Jun 2026 05:38:23 +0000 (22:38 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Wed, 1 Jul 2026 08:33:38 +0000 (10:33 +0200)
commit0bb99f2cfaae6822d734d69722de30af823efdf3
tree0e362f71c32615a1d66f83ce70655c69d01cdabe
parenta3af84b0fa00ead01fcd0e28b5d773ff25990a0d
bpf: Restrict JIT predictor flush to cBPF

Currently predictor flush on memory reuse is done for all BPF JIT
allocations, but only cBPF programs can be loaded by an unprivileged user.
eBPF is privileged by default, and flushing predictors for all CPUs on
every eBPF reuse penalizes the common case for no security benefit.

eBPF allocations can be frequent on busy systems, only flush predictors
for cBPF programs. Trampoline and dispatcher allocations also skip the
flush as they are eBPF-only.

Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
arch/arm64/net/bpf_jit_comp.c
arch/loongarch/net/bpf_jit.c
arch/powerpc/net/bpf_jit_comp.c
arch/riscv/net/bpf_jit_comp64.c
arch/riscv/net/bpf_jit_core.c
arch/x86/net/bpf_jit_comp.c
include/linux/filter.h
kernel/bpf/core.c
kernel/bpf/dispatcher.c