[packages/kernel] disable BPF_JIT_ALWAYS_ON on %{arm}

[atler]

commit 7af2726ce19443332fb8316a37651b39c00bca3d
Author: Jan Palus <atler at pld-linux.org>
Date:   Mon Oct 12 18:22:26 2026 +0200

    disable BPF_JIT_ALWAYS_ON on %{arm}
    
    bpf programs may fail to to be jitted for various reasons but once
    BPF_JIT_ALWAYS_ON is enabled interpreter is no longer available to
    fallback to. consequences are sometimes severe -- on armv6 (ie Raspberry
    Pi Zero) openssh fails to apply seccomp filter and bails with vague:
    
    prctl(PR_SET_SECCOMP): Unknown error 524 [preauth]
    
    without any trace of error in kernel logs. it takes some kernel
    debugging to figure openssh seccomp filter reached one of arch's limits:
    
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm/net/bpf_jit_32.c?h=v7.2#n440
    
    in normal circumstances program would fallback to interpreter providing
    it is available in the first place.

 kernel-multiarch.config | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
---
diff --git a/kernel-multiarch.config b/kernel-multiarch.config
index 7268da28..517ff995 100644
--- a/kernel-multiarch.config
+++ b/kernel-multiarch.config
@@ -14086,7 +14086,7 @@ SCHED_CORE=y
 #-
 BPF_SYSCALL all=y
 BPF_JIT all=y
-BPF_JIT_ALWAYS_ON all=y
+BPF_JIT_ALWAYS_ON all=y arm=n
 BPF_UNPRIV_DEFAULT_OFF all=y
 #- file kernel/bpf/preload/Kconfig goes here
 BPF_LSM all=y
================================================================

---- gitweb:

http://git.pld-linux.org/gitweb.cgi/packages/kernel.git/commitdiff/7af2726ce19443332fb8316a37651b39c00bca3d