| From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> |
| Date: Thu, 3 May 2018 13:45:58 -0500 |
| Subject: net: atm: Fix potential Spectre v1 |
| |
| commit acf784bd0ce257fe43da7ca266f7a10b837479d2 upstream. |
| |
| ioc_data.dev_num can be controlled by user-space, hence leading to |
| a potential exploitation of the Spectre variant 1 vulnerability. |
| |
| This issue was detected with the help of Smatch: |
| net/atm/lec.c:702 lec_vcc_attach() warn: potential spectre issue |
| 'dev_lec' |
| |
| Fix this by sanitizing ioc_data.dev_num before using it to index |
| dev_lec. Also, notice that there is another instance in which array |
| dev_lec is being indexed using ioc_data.dev_num at line 705: |
| lec_vcc_added(netdev_priv(dev_lec[ioc_data.dev_num]), |
| |
| Notice that given that speculation windows are large, the policy is |
| to kill the speculation on the first load and not worry if it can be |
| completed with a dependent load/store [1]. |
| |
| [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 |
| |
| Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| net/atm/lec.c | 9 +++++++-- |
| 1 file changed, 7 insertions(+), 2 deletions(-) |
| |
| --- a/net/atm/lec.c |
| +++ b/net/atm/lec.c |
| @@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = |
| #include <linux/module.h> |
| #include <linux/init.h> |
| |
| +/* Hardening for Spectre-v1 */ |
| +#include <linux/nospec.h> |
| + |
| #include "lec.h" |
| #include "lec_arpc.h" |
| #include "resources.h" |
| @@ -695,8 +698,10 @@ static int lec_vcc_attach(struct atm_vcc |
| bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); |
| if (bytes_left != 0) |
| pr_info("copy from user failed for %d bytes\n", bytes_left); |
| - if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || |
| - !dev_lec[ioc_data.dev_num]) |
| + if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF) |
| + return -EINVAL; |
| + ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF); |
| + if (!dev_lec[ioc_data.dev_num]) |
| return -EINVAL; |
| vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL); |
| if (!vpriv) |
