Received: by 10.223.185.116 with SMTP id b49csp1118964wrg; Fri, 23 Feb 2018 12:15:12 -0800 (PST) X-Google-Smtp-Source: AH8x2246o6jCuQZL2M3hmESWgUAUprPnb5dT5h5XpOPOynYKa8iQNcotgx1k4EfPj9KoLKzA+l1d X-Received: by 10.98.86.151 with SMTP id h23mr2843541pfj.79.1519416912127; Fri, 23 Feb 2018 12:15:12 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519416912; cv=none; d=google.com; s=arc-20160816; b=qVciSZtrpsC03e61u51XWK4NZxErUAFy7bB4zRv6zr4M5apudHJZLvuesDT4P9rH6a 1cZdiQmKAFpPgiVVQajzbgfWLKYTbEa6tACQQ0qTPBa42gVA+hu2bf86gCQAJX1c32Qj RSnCTB39StBnYMlLjdZ4m6O29LJyTwE3ROqRmk+OZYw+yVbb1jAIEWSKqO04yCbRaEPU 6ea3atQgOs5NIW1Gt3l63NoOyHwy/lh8ZRmTRTUKbmBLfwfpCazzwLH2U0BtZ18kK+3t EcrSyMKBr3R9fKy41WA9BWtAfd1dL6BT3fPaFKbuYzIP06F/kNWXUxMqKKmtzraIC3H+ BK8A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=zOmmE8Rh6SwuMiKhMRIgcENgXyQ1KiUW47QBlnBR7NE=; b=dMlb3QzDmpFdBDQJ0rYJad0JlBbr4hCpAko0DGB9jZnk/gaiWR/blneurKLA0+AxWE AxJZrrTJT4Q+oG3z5d7KHj3WOVv7HRTOQUGEa62EgRKFE7P4W/zquEPklZZtIBtUhpDG gdkIE8PGW1Tvd0owh4S8J2qXHQ8lBudmYUNVjjvbZaMEf/G1fs4uPDOftRmXQOJ9IR20 wTF2dAyNjy7UKV/wlGNABNGPppN121uCp5jvZ634C3qF9tbrmtz+46seYffn+F9pP/7J TpDBYJ73i/ikgeHfKFRe3EPooJrsx8bXG/V1sZ5MEfn8fK8QMaD0MhvWjkGHKVxZq1jw 42JA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id q69si1888476pgq.100.2018.02.23.12.14.57; Fri, 23 Feb 2018 12:15:12 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932777AbeBWSlO (ORCPT + 99 others); Fri, 23 Feb 2018 13:41:14 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:40442 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753520AbeBWSlK (ORCPT ); Fri, 23 Feb 2018 13:41:10 -0500 Received: from localhost (LFbn-1-12258-90.w90-92.abo.wanadoo.fr [90.92.71.90]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id BE25E1214; Fri, 23 Feb 2018 18:41:09 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Williams , Thomas Gleixner , linux-arch@vger.kernel.org, kernel-hardening@lists.openwall.com, Al Viro , torvalds@linux-foundation.org, alan@linux.intel.com, David Woodhouse , Jack Wang Subject: [PATCH 4.4 179/193] vfs, fdtable: Prevent bounds-check bypass via speculative execution Date: Fri, 23 Feb 2018 19:26:52 +0100 Message-Id: <20180223170354.207391528@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180223170325.997716448@linuxfoundation.org> References: <20180223170325.997716448@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams (cherry picked from commit 56c30ba7b348b90484969054d561f711ba196507) 'fd' is a user controlled value that is used as a data dependency to read from the 'fdt->fd' array. In order to avoid potential leaks of kernel memory values, block speculative execution of the instruction stream that could issue reads based on an invalid 'file *' returned from __fcheck_files. Co-developed-by: Elena Reshetova Signed-off-by: Dan Williams Signed-off-by: Thomas Gleixner Cc: linux-arch@vger.kernel.org Cc: kernel-hardening@lists.openwall.com Cc: gregkh@linuxfoundation.org Cc: Al Viro Cc: torvalds@linux-foundation.org Cc: alan@linux.intel.com Link: https://lkml.kernel.org/r/151727418500.33451.17392199002892248656.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: David Woodhouse [jwang: cherry pick to 4.4] Signed-off-by: Jack Wang Signed-off-by: Greg Kroah-Hartman --- include/linux/fdtable.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/include/linux/fdtable.h +++ b/include/linux/fdtable.h @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -81,8 +82,10 @@ static inline struct file *__fcheck_file { struct fdtable *fdt = rcu_dereference_raw(files->fdt); - if (fd < fdt->max_fds) + if (fd < fdt->max_fds) { + fd = array_index_nospec(fd, fdt->max_fds); return rcu_dereference_raw(fdt->fd[fd]); + } return NULL; }