Arm security updates as of 8th of January 2018
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAlpY0+sACgkQa9axLQDI
XvECHA//bwxTMp/MB7zNr8+xLjo02ghINcMFdjqO7xqX+8j25F3ya8u8E7BzzADZ
C3CJzfeqI3pJHluvVG9tcXGC8ArA5HSNu7MXeHXSPc4WSvAUJ9qMZa4MQaKHwurP
r55hqJRjz3cVGD+mUr4gBZ0pxdnntVTdN47j6/DeNHhKnhvspZwRtcQiwCor7zpg
hkJdFcf+XyECyFdG+sXPE7vRsZ5xP5gDeDIyLRCCMukkgzV9EMJGvaRjsXBMqHqS
G2tblhknafLxNUVRnjPAwcZnkw1GQEU5JFvtLNfwkCgYLsuh9GfNSRDxg2uixZGd
BzexWgB+xVHqODCCEHU+m7nDli3PNGPAtKfu0e6uZm0yBx5z63kyqgYmmw4Laey0
BmXbSGChjW6sbLs9y9TCx50H3s0RGqUIiYk2ZvxEpDzvLSU2AwhTK7IxBXoh6CNC
wUTeldEo5/hgNpZ9xHLzvdOdsZnJjGROf9yrSEMDFwlU5MWRDZfaHgz/Pvo1Remf
8rJnzAr4esnx+3cvYPBU3v8eJt9KeShu9GU8QXyOwBXpeOIlcmD5XqBIee/Xf+ZI
Y8uV1jV3W3uDENnaKzbG2wKwxwXSdY52LMw9Bq/plVKolbpW3w3+CkxpwWV6da2a
+Mt6YTut/eRzEVjAzgO/GM2X5SfrP5R4+D3yjRGD6jM+TL5xiZI=
=HEx5
-----END PGP SIGNATURE-----
bpf: inhibit speculated out-of-bounds pointers

Under speculation, CPUs may mis-predict branches in bounds checks. Thus,
memory accesses under a bounds check may be speculated even if the
bounds check fails, providing a primitive for building a side channel.

The EBPF map code has a number of such bounds-checks accesses in
map_lookup_elem implementations. This patch modifies these to use the
nospec helpers to inhibit such side channels.

The JITted lookup_elem implementations remain potentially vulnerable,
and are disabled (with JITted code falling back to the C
implementations).

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
4 files changed