| From foo@baz Fri Jan 4 19:53:50 CET 2019 |
| From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> |
| Date: Mon, 10 Dec 2018 12:41:24 -0600 |
| Subject: ipv4: Fix potential Spectre v1 vulnerability |
| |
| From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> |
| |
| [ Upstream commit 5648451e30a0d13d11796574919a359025d52cce ] |
| |
| vr.vifi is indirectly controlled by user-space, hence leading to |
| a potential exploitation of the Spectre variant 1 vulnerability. |
| |
| This issue was detected with the help of Smatch: |
| |
| net/ipv4/ipmr.c:1616 ipmr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) |
| net/ipv4/ipmr.c:1690 ipmr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap) |
| |
| Fix this by sanitizing vr.vifi before using it to index mrt->vif_table' |
| |
| Notice that given that speculation windows are large, the policy is |
| to kill the speculation on the first load and not worry if it can be |
| completed with a dependent load/store [1]. |
| |
| [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 |
| |
| Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| net/ipv4/ipmr.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/net/ipv4/ipmr.c |
| +++ b/net/ipv4/ipmr.c |
| @@ -68,6 +68,8 @@ |
| #include <linux/netconf.h> |
| #include <net/nexthop.h> |
| |
| +#include <linux/nospec.h> |
| + |
| struct ipmr_rule { |
| struct fib_rule common; |
| }; |
| @@ -1562,6 +1564,7 @@ int ipmr_compat_ioctl(struct sock *sk, u |
| return -EFAULT; |
| if (vr.vifi >= mrt->maxvif) |
| return -EINVAL; |
| + vr.vifi = array_index_nospec(vr.vifi, mrt->maxvif); |
| read_lock(&mrt_lock); |
| vif = &mrt->vif_table[vr.vifi]; |
| if (VIF_EXISTS(mrt, vr.vifi)) { |
