Received: by 2002:a05:6a10:6d25:0:0:0:0 with SMTP id gq37csp1874974pxb; Mon, 13 Sep 2021 07:21:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzSyI7HnZedy2IsL7KqFpnoNS+FvOqfPnY7EIqd3KTyG+nmywcFNp84GsU3ZW3IMOFCvF8S X-Received: by 2002:a17:906:4817:: with SMTP id w23mr12259226ejq.363.1631542864229; Mon, 13 Sep 2021 07:21:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631542864; cv=none; d=google.com; s=arc-20160816; b=oiWI86FjFtVId3reLLvmXNY7kcI0w3bvNvjoZBC1yLLagrJr7TYzbzRcpmJTXv/99n xxgueYC8tHX3F7ceBK0OCN3ossXdnc9+KMR2pljea4Xwf0X3Z1psePSmK3Bmb21Gcsat 9UDq7q2E8EIomlZ8VrpZz6voWmpdcNKQxwcOP7yD7qI1qMvRkvlP0GMPuPa9sYJ4+njv OMYPME/OgqJUsSz7cuP09yI6WQN1VMNDrQOYj1H0h1nUD19JSAz41MKJdA6tGL94M9S7 EjR6z9POku3O1nLcpebB2fIGNjW9TQp/x9jBRur9bWqpe5rbHdtF1crxbxZZlRl8lVS+ VlUA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=eTlUpAT2CD0Y2oIRJIjAsc+KzVIYSDfMwpMvhIH+nTo=; b=XeZaxHDDNeNy7M1HzGcxowr5jkdVAMFJs/63r5oUjSZZWpZ6T6DMWUff8KfIaOPM4A JHbpQ6nrIlewUlfzHBoPwXIx4/XQR13UVIghaLzz+Re+J9lnlV8E+kzbUq8f1iSq941u qJCQtzEKd8W6etnH5DgDovY4bayA6uZo6FxORihlUuwBkRdCs0VQLwnvq7d2D99xR1KG TSjpaLIMDZ1IW9W+R4CARoc7XXV18JMkMO7dxrO/rcqSBjm1QmuDpgrOXqA/ogU1t7ON 0UdqOXATVb1n21jsj6B12drSl5t8BwuqWbk2alasIYsceTZtfY7LKOCsaW+zw87gQIRp b7iQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=i3i+3aai; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id h14si9476615eje.454.2021.09.13.07.20.35; Mon, 13 Sep 2021 07:21:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=i3i+3aai; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343672AbhIMOSh (ORCPT + 99 others); Mon, 13 Sep 2021 10:18:37 -0400 Received: from mail.kernel.org ([198.145.29.99]:34432 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343893AbhIMONQ (ORCPT ); Mon, 13 Sep 2021 10:13:16 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 7DB296135D; Mon, 13 Sep 2021 13:43:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1631540583; bh=OQWEYWCNqFz7BJ+Vfj6msjEc1UTjXrWH86R0Qg8m5Zw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i3i+3aai6klC5Ei9qVqtMUEQ+VZWhoJxe+ckSYTURdtn6Qgp29ETzu3P5bOneOd7Q az9Y/ZkU81iJvyB5pRhiCbpidACJvOnmgq/H8c2CkuJKClPQPP15uRxezE9Qhs2EZ8 oqLKxkFb4dTePAEth+sNAfI0qHTJ+YcgeVQgI3jk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Keyu Man , Wei Wang , Martin KaFai Lau , David Ahern , "David S. Miller" , Sasha Levin Subject: [PATCH 5.13 252/300] ipv6: make exception cache less predictible Date: Mon, 13 Sep 2021 15:15:13 +0200 Message-Id: <20210913131117.867883730@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210913131109.253835823@linuxfoundation.org> References: <20210913131109.253835823@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Dumazet [ Upstream commit a00df2caffed3883c341d5685f830434312e4a43 ] Even after commit 4785305c05b2 ("ipv6: use siphash in rt6_exception_hash()"), an attacker can still use brute force to learn some secrets from a victim linux host. One way to defeat these attacks is to make the max depth of the hash table bucket a random value. Before this patch, each bucket of the hash table used to store exceptions could contain 6 items under attack. After the patch, each bucket would contains a random number of items, between 6 and 10. The attacker can no longer infer secrets. This is slightly increasing memory size used by the hash table, we do not expect this to be a problem. Following patch is dealing with the same issue in IPv4. Fixes: 35732d01fe31 ("ipv6: introduce a hash table to store dst cache") Signed-off-by: Eric Dumazet Reported-by: Keyu Man Cc: Wei Wang Cc: Martin KaFai Lau Reviewed-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/ipv6/route.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 67c74469503a..cd99de5b6882 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1657,6 +1657,7 @@ static int rt6_insert_exception(struct rt6_info *nrt, struct in6_addr *src_key = NULL; struct rt6_exception *rt6_ex; struct fib6_nh *nh = res->nh; + int max_depth; int err = 0; spin_lock_bh(&rt6_exception_lock); @@ -1711,7 +1712,9 @@ static int rt6_insert_exception(struct rt6_info *nrt, bucket->depth++; net->ipv6.rt6_stats->fib_rt_cache++; - if (bucket->depth > FIB6_MAX_DEPTH) + /* Randomize max depth to avoid some side channels attacks. */ + max_depth = FIB6_MAX_DEPTH + prandom_u32_max(FIB6_MAX_DEPTH); + while (bucket->depth > max_depth) rt6_exception_remove_oldest(bucket); out: -- 2.30.2