diff options
| author | Daniel Borkmann <daniel@iogearbox.net> | 2016-05-18 14:14:28 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-05-20 11:18:21 -0700 |
| commit | b7552e1bccbe3da9c8e7386c6188e8ea4667c8e7 (patch) | |
| tree | b688a09ce700098d34a06040dba03406feb0e439 | |
| parent | 09ec8e7fb6bcb351bbded18a571ea037504bb3a6 (diff) | |
| download | linux-b7552e1bccbe3da9c8e7386c6188e8ea4667c8e7.tar.gz linux-b7552e1bccbe3da9c8e7386c6188e8ea4667c8e7.tar.bz2 linux-b7552e1bccbe3da9c8e7386c6188e8ea4667c8e7.zip | |
bpf: rather use get_random_int for randomizations
Start address randomization and blinding in BPF currently use
prandom_u32(). prandom_u32() values are not exposed to unpriviledged
user space to my knowledge, but given other kernel facilities such as
ASLR, stack canaries, etc make use of stronger get_random_int(), we
better make use of it here as well given blinding requests successively
new random values. get_random_int() has minimal entropy pool depletion,
is not cryptographically secure, but doesn't need to be for our use
cases here.
Suggested-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | kernel/bpf/core.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index f1e8a0def99b..b94a36550591 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -231,7 +231,7 @@ bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, hdr->pages = size / PAGE_SIZE; hole = min_t(unsigned int, size - (proglen + sizeof(*hdr)), PAGE_SIZE - sizeof(*hdr)); - start = (prandom_u32() % hole) & ~(alignment - 1); + start = (get_random_int() % hole) & ~(alignment - 1); /* Leave a random number of instructions before BPF code. */ *image_ptr = &hdr->image[start]; @@ -251,7 +251,7 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from, struct bpf_insn *to_buff) { struct bpf_insn *to = to_buff; - u32 imm_rnd = prandom_u32(); + u32 imm_rnd = get_random_int(); s16 off; BUILD_BUG_ON(BPF_REG_AX + 1 != MAX_BPF_JIT_REG); |