Sami Tolvanen 89aed473c5 ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI ...

With CONFIG_BPF_JIT, the kernel makes indirect calls to dynamically
generated code, which the compile-time Control-Flow Integrity (CFI)
checking cannot validate. This change adds basic sanity checking to
ensure we are jumping to a valid location, which narrows down the
attack surface on the stored pointer.

In addition, this change adds a weak arch_bpf_jit_check_func function,
which architectures that implement BPF JIT can override to perform
additional validation, such as verifying that the pointer points to
the correct memory region.

Bug: 140377409
Change-Id: I8ebac6637ab6bd9db44716b1c742add267298669
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
(cherry picked from commit 9a11e8da57)

2019-10-08 09:21:03 -07:00

..

arraymap.c

bpf: decouple btf from seq bpf fs dump and enable more maps

2018-08-13 00:52:45 +02:00

bpf_lru_list.c

…

bpf_lru_list.h

…

btf.c

bpf: btf: Fix end boundary calculation for type section

2018-09-12 22:00:23 +02:00

cgroup.c

bpf: introduce update_effective_progs()

2018-08-07 14:29:55 +02:00

core.c

ANDROID: bpf: validate bpf_func when BPF_JIT is enabled with CFI

2019-10-08 09:21:03 -07:00

cpumap.c

bpf: fix redirect to map under tail calls

2018-08-17 15:56:23 -07:00

devmap.c

bpf, devmap: Add missing RCU read lock on flush

2019-07-14 08:11:11 +02:00

disasm.c

…

disasm.h

…

hashtab.c

bpf, lru: avoid messing with eviction heuristics upon syscall lookup

2019-05-25 18:23:48 +02:00

helpers.c

bpf: introduce the bpf_get_local_storage() helper function

2018-08-03 00:47:32 +02:00

inode.c

bpf: relax inode permission check for retrieving bpf program

2019-05-25 18:23:47 +02:00

local_storage.c

bpf: allocate local storage buffers using GFP_ATOMIC

2018-12-17 09:24:33 +01:00

lpm_trie.c

bpf: lpm_trie: check left child of last leftmost node for NULL

2019-07-03 13:14:48 +02:00

Makefile

bpf: silence warning messages in core

2019-07-26 09:14:06 +02:00

map_in_map.c

bpf: fix inner map masking to prevent oob under speculation

2019-01-31 08:14:41 +01:00

map_in_map.h

…

offload.c

bpf: offload: allow program and map sharing per-ASIC

2018-07-18 15:10:34 +02:00

percpu_freelist.c

bpf: fix lockdep false positive in percpu_freelist

2019-03-13 14:02:36 -07:00

percpu_freelist.h

bpf: fix lockdep false positive in percpu_freelist

2019-03-13 14:02:36 -07:00

reuseport_array.c

bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY

2018-08-11 01:58:46 +02:00

sockmap.c

bpf: sockmap, fix transition through disconnect without close

2018-09-22 02:46:41 +02:00

stackmap.c

bpf: fix lockdep false positive in stackmap

2019-03-23 20:09:48 +01:00

syscall.c

bpf: fix use after free in prog symbol exposure

2019-10-07 18:57:19 +02:00

tnum.c

…

verifier.c

bpf: fix unconnected udp hooks

2019-07-03 13:14:48 +02:00

xskmap.c

xsk: do not call synchronize_net() under RCU read lock

2018-10-11 10:19:01 +02:00