Received: by 10.223.185.116 with SMTP id b49csp1118864wrg; Fri, 23 Feb 2018 12:15:06 -0800 (PST) X-Google-Smtp-Source: AH8x22641XLQIl4ATixcuQhxVyHWk/Sr3cjLr6H4gH2bpYdk4rDlMtg8NpJwCA+8JVRGvqxExztb X-Received: by 2002:a17:902:66e6:: with SMTP id e93-v6mr2786723plk.312.1519416906385; Fri, 23 Feb 2018 12:15:06 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519416906; cv=none; d=google.com; s=arc-20160816; b=Rqdk3JRcO5S0l1khxMrIPjuvOIYLsthQSXvqBi5m/B0sHYBA33uMtlkAxhYcbhXAnX tjBVyEkf08vZsw+DGaM7yIR1/XBjhZ4F5qRuvTLS2kyGJT0RBUZt10mInOH89mbWl428 ZYyW/77Qt50FcBBmAc/p26ZwBsk5gFbj0AxYJacsc8DvzYyCCG+t9EAdKDcPyUSJop0Y uGTmlTejF3hc5ITHgNjW8IzkrOiwStO49EQu7z3H7SjWptHWi39LGLWGHcLLtL6vhPP0 K6LRtj1DMGytwAI0W4n6vqQMzxi4Ae7H3zw/6pT5r/ixkMzfDyfohZ6VqUUelW9zS5Gp EfUQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=SwJ9WJ7ES/L+799LkA7qFuOZDpkME8PcL8MwBLOOTjg=; b=bGLIxFCvMYIerALTzPKT8qQNHL/N0oGs8/3BatOTMUq45auAz4vCVFkFWF4seR9k0T ur9ZIDQDzvU1IMs6V5RP5kkCV3Z+QxGV8ExU4WFHyHi/R6wGmJcbiX4WIoPtoR5Or40u FlmVHdNFZ3VCwOKcWGsjeOWH3KQ+Ymuf4E7tnq8Yd9y9V20KAkmOCWG8P4v0Orrt8Dzm ssjm0s6yH+JcqyGmfDOVkUMTR3F1qfHlhi09NXMtq1No2PbDEEnl/vm10dYcK3aXjuPP kJ8jWQo+d6bHSoqmItkH6bCD1A+xl4OJ8XNLZ8IKzrT5OhhO0UfENa3jAcJj+22VTgLb IKxQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k20-v6si2164742pll.645.2018.02.23.12.14.51; Fri, 23 Feb 2018 12:15:06 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755189AbeBWUOR (ORCPT + 99 others); Fri, 23 Feb 2018 15:14:17 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:40422 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932738AbeBWSlH (ORCPT ); Fri, 23 Feb 2018 13:41:07 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 5CAD11291; Fri, 23 Feb 2018 18:41:06 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Dan Williams , Thomas Gleixner , linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com, Andy Lutomirski , alan@linux.intel.com, David Woodhouse , Jack Wang Subject: [PATCH 4.4 178/193] x86/syscall: Sanitize syscall table de-references under speculation Date: Fri, 23 Feb 2018 19:26:51 +0100 Message-Id: <20180223170354.028619665@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams (cherry picked from commit 2fbd7af5af8665d18bcefae3e9700be07e22b681) The syscall table base is a user controlled function pointer in kernel space. Use array_index_nospec() to prevent any out of bounds speculation. While retpoline prevents speculating into a userspace directed target it does not stop the pointer de-reference, the concern is leaking memory relative to the syscall table base, by observing instruction cache behavior. Reported-by: Linus Torvalds Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Cc: linux-arch@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: gregkh@linuxfoundation.org Cc: Andy Lutomirski Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727417984.33451.1216731042505722161.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse [jwang: port to 4.4, no syscall_64] Signed-off-by: Jack Wang Signed-off-by: Greg Kroah-Hartman --- arch/x86/entry/common.c | 2 ++ 1 file changed, 2 insertions(+) --- a/arch/x86/entry/common.c +++ b/arch/x86/entry/common.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -381,6 +382,7 @@ __always_inline void do_syscall_32_irqs_ } if (likely(nr < IA32_NR_syscalls)) { + nr = array_index_nospec(nr, IA32_NR_syscalls); /* * It's possible that a 32-bit syscall implementation * takes a 64-bit parameter but nonetheless assumes that