Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754041AbeAFBTt (ORCPT + 1 other); Fri, 5 Jan 2018 20:19:49 -0500 Received: from mga11.intel.com ([192.55.52.93]:40067 "EHLO mga11.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753938AbeAFBTq (ORCPT ); Fri, 5 Jan 2018 20:19:46 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.46,320,1511856000"; d="scan'208";a="24777668" Subject: [PATCH 18/18] userns: prevent bounds-check bypass via speculative execution From: Dan Williams To: linux-kernel@vger.kernel.org Cc: linux-arch@vger.kernel.org, peterz@infradead.org, netdev@vger.kernel.org, "Eric W. Biederman" , gregkh@linuxfoundation.org, tglx@linutronix.de, torvalds@linux-foundation.org, Elena Reshetova , alan@linux.intel.com Date: Fri, 05 Jan 2018 17:11:32 -0800 Message-ID: <151520109193.32271.1578212450835287742.stgit@dwillia2-desk3.amr.corp.intel.com> In-Reply-To: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com> References: <151520099201.32271.4677179499894422956.stgit@dwillia2-desk3.amr.corp.intel.com> User-Agent: StGit/0.17.1-9-g687f MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: Static analysis reports that 'pos' may be a user controlled value that is used as a data dependency determining which extent to return out of 'map'. In order to avoid potential leaks of kernel memory values, block speculative execution of the instruction stream that could issue further reads based on an invalid speculative result from 'm_start()'. Based on an original patch by Elena Reshetova. Cc: "Eric W. Biederman" Signed-off-by: Elena Reshetova Signed-off-by: Dan Williams --- kernel/user_namespace.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 246d4d4ce5c7..e958f2e5c061 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -648,15 +648,13 @@ static void *m_start(struct seq_file *seq, loff_t *ppos, { loff_t pos = *ppos; unsigned extents = map->nr_extents; - smp_rmb(); - if (pos >= extents) - return NULL; + /* paired with smp_wmb in map_write */ + smp_rmb(); if (extents <= UID_GID_MAP_MAX_BASE_EXTENTS) - return &map->extent[pos]; - - return &map->forward[pos]; + return nospec_array_ptr(map->extent, pos, extents); + return nospec_array_ptr(map->forward, pos, extents); } static void *uid_m_start(struct seq_file *seq, loff_t *ppos)