net: core: Fix Spectre v1 vulnerability
flen is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. This issue was detected with the help of Smatch: net/core/filter.c:1101 bpf_check_classic() warn: potential spectre issue 'filter' [w] Fix this by sanitizing flen before using it to index filter at line 1101: switch (filter[flen - 1].code) { and through pc at line 1040: const struct sock_filter *ftest = &filter[pc]; Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
6cafab50ee
commit
50d5258634
|
@ -73,6 +73,7 @@
|
||||||
#include <linux/seg6_local.h>
|
#include <linux/seg6_local.h>
|
||||||
#include <net/seg6.h>
|
#include <net/seg6.h>
|
||||||
#include <net/seg6_local.h>
|
#include <net/seg6_local.h>
|
||||||
|
#include <linux/nospec.h>
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* sk_filter_trim_cap - run a packet through a socket filter
|
* sk_filter_trim_cap - run a packet through a socket filter
|
||||||
|
@ -1038,6 +1039,7 @@ static int bpf_check_classic(const struct sock_filter *filter,
|
||||||
bool anc_found;
|
bool anc_found;
|
||||||
int pc;
|
int pc;
|
||||||
|
|
||||||
|
flen = array_index_nospec(flen, BPF_MAXINSNS + 1);
|
||||||
/* Check the filter code now */
|
/* Check the filter code now */
|
||||||
for (pc = 0; pc < flen; pc++) {
|
for (pc = 0; pc < flen; pc++) {
|
||||||
const struct sock_filter *ftest = &filter[pc];
|
const struct sock_filter *ftest = &filter[pc];
|
||||||
|
|
Loading…
Reference in a new issue