diff options
| author | Alexei Starovoitov <ast@fb.com> | 2017-12-14 17:55:14 -0800 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2017-12-17 20:34:36 +0100 |
| commit | 60b58afc96c9df71871df2dbad42037757ceef26 (patch) | |
| tree | 5651c4845120fc28c9712f53f31962adfd4abe73 /include | |
| parent | 1ea47e01ad6ea0fe99697c54c2413d81dd21fe32 (diff) | |
| download | linux-60b58afc96c9df71871df2dbad42037757ceef26.tar.gz linux-60b58afc96c9df71871df2dbad42037757ceef26.tar.bz2 linux-60b58afc96c9df71871df2dbad42037757ceef26.zip | |
bpf: fix net.core.bpf_jit_enable race
global bpf_jit_enable variable is tested multiple times in JITs,
blinding and verifier core. The malicious root can try to toggle
it while loading the programs. This race condition was accounted
for and there should be no issues, but it's safer to avoid
this race condition.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'include')
| -rw-r--r-- | include/linux/filter.h | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/include/linux/filter.h b/include/linux/filter.h index f26e6da1007b..3d6edc34932c 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -458,6 +458,7 @@ struct bpf_binary_header { struct bpf_prog { u16 pages; /* Number of allocated pages */ u16 jited:1, /* Is our filter JIT'ed? */ + jit_requested:1,/* archs need to JIT the prog */ locked:1, /* Program image locked? */ gpl_compatible:1, /* Is filter GPL compatible? */ cb_access:1, /* Is control block accessed? */ @@ -804,7 +805,7 @@ static inline bool bpf_prog_ebpf_jited(const struct bpf_prog *fp) return fp->jited && bpf_jit_is_ebpf(); } -static inline bool bpf_jit_blinding_enabled(void) +static inline bool bpf_jit_blinding_enabled(struct bpf_prog *prog) { /* These are the prerequisites, should someone ever have the * idea to call blinding outside of them, we make sure to @@ -812,7 +813,7 @@ static inline bool bpf_jit_blinding_enabled(void) */ if (!bpf_jit_is_ebpf()) return false; - if (!bpf_jit_enable) + if (!prog->jit_requested) return false; if (!bpf_jit_harden) return false; |