Eric Dumazet 314beb9bca x86: bpf_jit_comp: secure bpf jit against spraying attacks ... hpa bringed into my attention some security related issues with BPF JIT on x86. This patch makes sure the bpf generated code is marked read only, as other kernel text sections. It also splits the unused space (we vmalloc() and only use a fraction of the page) in two parts, so that the generated bpf code not starts at a known offset in the page, but a pseudo random one. Refs: http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html Reported-by: H. Peter Anvin <hpa@zytor.com> Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2013-05-19 23:55:41 -07:00
..
Makefile	net: filter: Just In Time compiler for x86-64	2011-04-27 23:05:08 -07:00
bpf_jit.S	bpf jit: Let the x86 jit handle negative offsets	2012-04-03 18:01:41 -04:00
bpf_jit_comp.c	x86: bpf_jit_comp: secure bpf jit against spraying attacks	2013-05-19 23:55:41 -07:00