Daniel Borkmann 55309dd3d4 net: bpf: arm: address randomize and write protect JIT code ... This is the ARM variant for 314beb9bca ("x86: bpf_jit_comp: secure bpf jit against spraying attacks"). It is now possible to implement it due to commits 75374ad47c ("ARM: mm: Define set_memory_* functions for ARM") and dca9aa92fc ("ARM: add DEBUG_SET_MODULE_RONX option to Kconfig") which added infrastructure for this facility. Thus, this patch makes sure the BPF generated JIT code is marked RO, as other kernel text sections, and also lets the generated JIT code start at a pseudo random offset instead on a page boundary. The holes are filled with illegal instructions. JIT tested on armv7hl with BPF test suite. Reference: http://mainisusuallyafunction.blogspot.com/2012/11/attacking-hardened-linux-systems-with.html Signed-off-by: Daniel Borkmann <dborkman@redhat.com> Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> Acked-by: Mircea Gherzan <mgherzan@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2014-09-09 16:58:56 -07:00
..
bpf_jit_32.c	net: bpf: arm: address randomize and write protect JIT code	2014-09-09 16:58:56 -07:00
bpf_jit_32.h	ARM: net: bpf_jit_32: add XOR instruction for BPF JIT	2012-11-13 18:21:10 -05:00
Makefile