Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754001AbeAFBTk (ORCPT + 1 other); Fri, 5 Jan 2018 20:19:40 -0500 Received: from mga07.intel.com ([134.134.136.100]:38660 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753938AbeAFBTg (ORCPT ); Fri, 5 Jan 2018 20:19:36 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,320,1511856000"; d="scan'208";a="192645711" Subject: [PATCH 16/18] net: mpls: prevent bounds-check bypass via speculative execution From: Dan Williams To: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org, peterz@infradead.org, netdev@vger.kernel.org, "Eric W. Biederman" , gregkh@linuxfoundation.org, tglx@linutronix.de, torvalds@linux-foundation.org, "David S. Miller" , Elena Reshetova , alan@linux.intel.com Date: Fri, 05 Jan 2018 17:11:20 -0800 Message-ID: <151520108080.32271.16420298348259030860.stgit@dwillia2-desk3.amr.corp.intel.com> In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com> References: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com> User-Agent: StGit/0.17.1-9-g687f MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Static analysis reports that 'index' may be a user controlled value that is used as a data dependency reading 'rt' from the 'platform_label' array. In order to avoid potential leaks of kernel memory values, block speculative execution of the instruction stream that could issue further reads based on an invalid 'rt' value. Based on an original patch by Elena Reshetova. Cc: "David S. Miller" Cc: Eric W. Biederman Cc: netdev@vger.kernel.org Signed-off-by: Elena Reshetova Signed-off-by: Dan Williams --- net/mpls/af_mpls.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c index 8ca9915befc8..ebcf0e246cfe 100644 --- a/net/mpls/af_mpls.c +++ b/net/mpls/af_mpls.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include @@ -77,12 +78,13 @@ static void rtmsg_lfib(int event, u32 label, struct mpls_route *rt, static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index) { struct mpls_route *rt = NULL; + struct mpls_route __rcu **platform_label = + rcu_dereference(net->mpls.platform_label); + struct mpls_route __rcu **rtp; - if (index < net->mpls.platform_labels) { - struct mpls_route __rcu **platform_label = - rcu_dereference(net->mpls.platform_label); - rt = rcu_dereference(platform_label[index]); - } + if ((rtp = nospec_array_ptr(platform_label, index, + net->mpls.platform_labels))) + rt = rcu_dereference(*rtp); return rt; }