Messages in this thread Patch in this message | | | From | KP Singh <> | Subject | [PATCH bpf-next v3 07/10] bpf: lsm: Make the allocated callback RO+X | Date | Thu, 23 Jan 2020 07:24:37 -0800 |
| |
From: KP Singh <kpsingh@google.com>
This patch is not needed after arch_bpf_prepare_trampoline moves to using text_poke.
The two IPI TLB flushes can be further optimized if a new API to handle W^X in the kernel emerges as an outcome of:
https://lore.kernel.org/bpf/20200103234725.22846-1-kpsingh@chromium.org/
Signed-off-by: KP Singh <kpsingh@google.com> Reviewed-by: Brendan Jackman <jackmanb@google.com> Reviewed-by: Florent Revest <revest@google.com> Reviewed-by: Thomas Garnier <thgarnie@google.com> --- security/bpf/hooks.c | 9 +++++++++ 1 file changed, 9 insertions(+)
diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c index f1d4fdcdb20e..beeeb8c1f9c2 100644 --- a/security/bpf/hooks.c +++ b/security/bpf/hooks.c @@ -190,6 +190,15 @@ static struct bpf_lsm_hook *bpf_lsm_hook_alloc(struct bpf_lsm_list *list, goto error; } + /* First make the page read-only, and only then make it executable to + * prevent it from being W+X in between. + */ + set_memory_ro((unsigned long)image, 1); + /* More checks can be done here to ensure that nothing was changed + * between arch_prepare_bpf_trampoline and set_memory_ro. + */ + set_memory_x((unsigned long)image, 1); + hook = kzalloc(sizeof(struct bpf_lsm_hook), GFP_KERNEL); if (!hook) { ret = -ENOMEM; -- 2.20.1
| |