diff options
| author | Sami Tolvanen <samitolvanen@google.com> | 2019-09-04 14:08:16 -0700 |
|---|---|---|
| committer | Michael Bestas <mkbestas@lineageos.org> | 2022-04-19 00:51:53 +0300 |
| commit | 1f459d731993dcaa501ec8fd6b03ff43f42bf108 (patch) | |
| tree | fbcc3315bcbd81cf9b5b2cf3e3d6882d84b8fa89 /net/ipv6/tcp_ipv6.c | |
| parent | c6da67a69b16e2f7ad9127b5f047d10b3c8a20b3 (diff) | |
ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI
With CONFIG_BPF_JIT, the kernel makes indirect calls to dynamically
generated code, which the compile-time Control-Flow Integrity (CFI)
checking cannot validate. This change adds basic sanity checking to
ensure we are jumping to a valid location, which narrows down the
attack surface on the stored pointer.
In addition, this change adds a weak arch_bpf_jit_check_func function,
which architectures that implement BPF JIT can override to perform
additional validation, such as verifying that the pointer points to
the correct memory region.
Bug: 140377409
Change-Id: I8ebac6637ab6bd9db44716b1c742add267298669
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Diffstat (limited to 'net/ipv6/tcp_ipv6.c')
0 files changed, 0 insertions, 0 deletions