| From foo@baz Thu Feb 8 03:32:24 CET 2018 |
| From: Dan Williams <dan.j.williams@intel.com> |
| Date: Mon, 29 Jan 2018 17:03:05 -0800 |
| Subject: vfs, fdtable: Prevent bounds-check bypass via speculative execution |
| |
| From: Dan Williams <dan.j.williams@intel.com> |
| |
| |
| (cherry picked from commit 56c30ba7b348b90484969054d561f711ba196507) |
| |
| 'fd' is a user controlled value that is used as a data dependency to |
| read from the 'fdt->fd' array. In order to avoid potential leaks of |
| kernel memory values, block speculative execution of the instruction |
| stream that could issue reads based on an invalid 'file *' returned from |
| __fcheck_files. |
| |
| Co-developed-by: Elena Reshetova <elena.reshetova@intel.com> |
| Signed-off-by: Dan Williams <dan.j.williams@intel.com> |
| Signed-off-by: Thomas Gleixner <tglx@linutronix.de> |
| Cc: linux-arch@vger.kernel.org |
| Cc: kernel-hardening@lists.openwall.com |
| Cc: gregkh@linuxfoundation.org |
| Cc: Al Viro <viro@zeniv.linux.org.uk> |
| Cc: torvalds@linux-foundation.org |
| Cc: alan@linux.intel.com |
| Link: https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.stgit@dwillia2-desk3.amr.corp.intel.com |
| Signed-off-by: David Woodhouse <dwmw@amazon.co.uk> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| include/linux/fdtable.h | 5 ++++- |
| 1 file changed, 4 insertions(+), 1 deletion(-) |
| |
| --- a/include/linux/fdtable.h |
| +++ b/include/linux/fdtable.h |
| @@ -9,6 +9,7 @@ |
| #include <linux/compiler.h> |
| #include <linux/spinlock.h> |
| #include <linux/rcupdate.h> |
| +#include <linux/nospec.h> |
| #include <linux/types.h> |
| #include <linux/init.h> |
| #include <linux/fs.h> |
| @@ -81,8 +82,10 @@ static inline struct file *__fcheck_file |
| { |
| struct fdtable *fdt = rcu_dereference_raw(files->fdt); |
| |
| - if (fd < fdt->max_fds) |
| + if (fd < fdt->max_fds) { |
| + fd = array_index_nospec(fd, fdt->max_fds); |
| return rcu_dereference_raw(fdt->fd[fd]); |
| + } |
| return NULL; |
| } |
| |