Files
kernel_arpi/include/linux
Sami Tolvanen 788bbf4f26 ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI
With CONFIG_BPF_JIT, the kernel makes indirect calls to dynamically
generated code, which the compile-time Control-Flow Integrity (CFI)
checking cannot validate. This change adds basic sanity checking to
ensure we are jumping to a valid location, which narrows down the
attack surface on the stored pointer.

In addition, this change adds a weak arch_bpf_jit_check_func function,
which architectures that implement BPF JIT can override to perform
additional validation, such as verifying that the pointer points to
the correct memory region.

Bug: 145210207
Change-Id: I1a90c70cdcef25673a870d3c4f2586a829c0d32e
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
2019-11-26 13:27:46 -08:00
..
2019-09-17 10:27:46 -07:00
2019-09-16 09:56:27 -07:00
2019-10-02 19:10:07 +02:00
2019-10-28 13:11:46 +01:00
2019-09-05 19:52:33 -06:00
2019-10-02 19:10:07 +02:00
2019-09-05 11:40:54 +02:00
2019-09-24 15:54:08 -07:00
2019-10-02 06:36:50 -07:00
2019-09-07 04:28:05 -03:00
2019-09-02 11:43:54 +01:00
2019-09-05 12:32:05 +02:00
2019-11-26 13:27:37 -08:00
2019-10-04 18:11:08 -07:00
2019-08-23 16:39:26 +01:00
2019-10-26 19:24:41 +02:00
2019-10-31 14:01:40 -07:00
2019-09-25 17:51:41 -07:00
2019-09-07 21:42:25 +02:00
2019-10-02 10:06:45 +02:00
2019-08-30 07:27:17 -07:00
2019-10-14 15:04:01 -07:00