Commit 10528b9c authored by Naveen N. Rao's avatar Naveen N. Rao Committed by Michael Ellerman

powerpc/bpf: Flush the entire JIT buffer

With bpf_jit_binary_alloc(), we allocate at a page granularity and fill
the rest of the space with illegal instructions to mitigate BPF spraying
attacks, while having the actual JIT'ed BPF program at a random location
within the allocated space. Under this scenario, it would be better to
flush the entire allocated buffer rather than just the part containing
the actual program. We already flush the buffer from start to the end of
the BPF program. Extend this to include the illegal instructions after
the BPF program.
Signed-off-by: default avatarNaveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
parent 052de33c
...@@ -1046,8 +1046,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) ...@@ -1046,8 +1046,6 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
*/ */
bpf_jit_dump(flen, proglen, pass, code_base); bpf_jit_dump(flen, proglen, pass, code_base);
bpf_flush_icache(bpf_hdr, image + alloclen);
#ifdef PPC64_ELF_ABI_v1 #ifdef PPC64_ELF_ABI_v1
/* Function descriptor nastiness: Address + TOC */ /* Function descriptor nastiness: Address + TOC */
((u64 *)image)[0] = (u64)code_base; ((u64 *)image)[0] = (u64)code_base;
...@@ -1057,6 +1055,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp) ...@@ -1057,6 +1055,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
fp->bpf_func = (void *)image; fp->bpf_func = (void *)image;
fp->jited = 1; fp->jited = 1;
bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + (bpf_hdr->pages * PAGE_SIZE));
out: out:
kfree(addrs); kfree(addrs);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment