[PATCH v3 net-next] fix unsafe set_memory_rw from softirq
edumazet at google.com
Fri Oct 4 23:56:29 EST 2013
> I took a brief look at arch/x86/net/bpf_jit_comp.c while reviewing this
> You need to split up bpf_jit_compile(), it's an obscenely large, ~600
> lines long function. We don't do that in modern, maintainable kernel code.
> This 128 bytes extra padding:
> /* Most of BPF filters are really small,
> * but if some of them fill a page, allow at least
> * 128 extra bytes to insert a random section of int3
> sz = round_up(proglen + sizeof(*header) + 128, PAGE_SIZE);
> why is it done? It's not clear to me from the comment.
Author: Eric Dumazet <edumazet at google.com>
Date: Fri May 17 16:37:03 2013 +0000
x86: bpf_jit_comp: secure bpf jit against spraying attacks
hpa bringed into my attention some security related issues
with BPF JIT on x86.
This patch makes sure the bpf generated code is marked read only,
as other kernel text sections.
It also splits the unused space (we vmalloc() and only use a fraction of
the page) in two parts, so that the generated bpf code not starts at a
known offset in the page, but a pseudo random one.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Linuxppc-dev