redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity
remarkable-linux/net
History
Dan Williams 93f3aff1d9 mpls, nospec: Sanitize array index in mpls_label_ok() 
commit 3968523f85 upstream.

mpls_label_ok() validates that the 'platform_label' array index from a
userspace netlink message payload is valid. Under speculation the
mpls_label_ok() result may not resolve in the CPU pipeline until after
the index is used to access an array element. Sanitize the index to zero
to prevent userspace-controlled arbitrary out-of-bounds speculation, a
precursor for a speculative execution side channel vulnerability.

Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 4.4:
 - mpls_label_ok() doesn't take an extack parameter
 - Drop change in mpls_getroute()]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 		2018-03-11 16:21:34 +01:00
..
6lowpan 6lowpan: ndisc: no overreact if no short address is available 2016-09-19 20:19:34 +02:00
9p 9p/trans_virtio: discard zero-length reply 2018-02-22 15:43:50 +01:00
802 net: Kill dev_rebuild_header 2015-03-02 16:43:41 -05:00
8021q 8021q: fix a memory leak for VLAN 0 device 2018-01-17 09:38:52 +01:00
appletalk appletalk: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
atm lec: use IS_ENABLED() instead of checking for built-in or module 2016-09-10 21:19:10 -07:00
ax25 ax25: Fix segfault after sock connection timeout 2017-02-04 09:47:09 +01:00
batman-adv batman-adv: Check for alloc errors when preparing TT local data 2016-12-02 10:46:59 +01:00
bluetooth Bluetooth: Prevent stack info leak from the EFS element. 2018-01-17 09:38:56 +01:00
bridge bridge: check brport attr show in brport_show 2018-03-11 16:21:31 +01:00
caif net: caif: Fix a sleep-in-atomic bug in cfpkt_create_pfx 2017-07-05 14:40:14 +02:00
can can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once 2018-01-31 12:55:50 +01:00
ceph libceph: don't WARN() if user tries to add invalid key 2017-11-30 08:39:03 +00:00
core net: fix race on decreasing number of TX queues 2018-03-11 16:21:31 +01:00
dcb net: dcb: set error code on failures 2016-12-03 23:54:25 -05:00
dccp dccp: CVE-2017-8824: use-after-free in DCCP code 2018-02-17 13:21:13 +01:00
decnet dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock 2018-02-25 11:05:44 +01:00
dns_resolver KEYS: Fix race between updating and finding a negative key 2017-10-27 10:38:11 +02:00
dsa net: dsa: select NET_SWITCHDEV 2017-11-15 15:53:17 +01:00
ethernet net: introduce device min_header_len 2017-02-18 15:11:43 +01:00
hsr net/hsr: Remove unused but set variable 2016-10-18 10:28:18 -04:00
ieee802154 Revert "net: fix percpu memory leaks" 2017-09-20 08:19:55 +02:00
ipv4 tcp_bbr: better deal with suboptimal GSO 2018-03-11 16:21:33 +01:00
ipv6 udplite: fix partial checksum initialization 2018-03-11 16:21:32 +01:00
ipx ipx: call ipxitf_put() in ioctl error path 2017-05-25 15:44:41 +02:00
irda irda: do not leak initialized list.dev to userspace 2017-08-30 10:21:42 +02:00
iucv net/af_iucv: don't use paged skbs for TX on HiperSockets 2017-01-19 20:18:04 +01:00
kcm kcm: Only allow TCP sockets to be attached to a KCM mux 2018-02-25 11:05:40 +01:00
key af_key: fix buffer overread in parse_exthdrs() 2018-01-23 19:57:05 +01:00
l2tp l2tp: cleanup l2tp_tunnel_delete calls 2017-12-20 10:07:31 +01:00
l3mdev net: ipv6: Remove l3mdev_get_saddr6 2016-09-10 23:12:53 -07:00
lapb net/lapb: tuse %*ph to dump buffers 2016-05-29 22:33:25 -07:00
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-02-26 11:10:50 +01:00
mac80211 mac80211: mesh: drop frames appearing to be from us 2018-03-03 10:23:27 +01:00
mac802154 mac802154: use rate limited warnings for malformed frames 2016-09-19 20:19:34 +02:00
mpls mpls, nospec: Sanitize array index in mpls_label_ok() 2018-03-11 16:21:34 +01:00
ncsi net/ncsi: Improve HNCDSC AEN handler 2016-10-20 11:23:08 -04:00
netfilter netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert 2018-02-25 11:05:43 +01:00
netlabel netlabel: Implement CALIPSO config functions for SMACK. 2016-06-27 15:06:18 -04:00
netlink netlink: ensure to loop over all netns in genlmsg_multicast_allns() 2018-03-11 16:21:32 +01:00
netrom netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00
nfc NFC: fix device-allocation error return 2017-11-30 08:39:07 +00:00
openvswitch openvswitch: fix the incorrect flow action alloc size 2018-02-03 17:05:37 +01:00
packet net/packet: fix a race in packet_bind() and packet_notifier() 2017-12-16 16:25:45 +01:00
phonet sock: struct proto hash function may error 2016-02-11 03:54:14 -05:00
qrtr net: qrtr: Mark 'buf' as little endian 2017-12-09 22:01:51 +01:00
rds rds: tcp: atomically purge entries from rds_tcp_conn_list during netns delete 2018-02-25 11:05:43 +01:00
rfkill rfkill: Use switch to demux userspace operations 2016-04-05 10:48:53 +02:00
rose rose: limit sk_filter trim to payload 2016-07-13 11:53:40 -07:00
rxrpc rxrpc: Fix send in rxrpc_send_data_packet() 2018-03-11 16:21:32 +01:00
sched net_sched: red: Avoid illegal values 2018-02-25 11:05:48 +01:00
sctp sctp: verify size of a new chunk in _sctp_make_chunk() 2018-03-11 16:21:34 +01:00
strparser strparser: destroy workqueue on module exit 2017-03-22 12:43:33 +01:00
sunrpc SUNRPC: Allow connect to return EHOSTUNREACH 2018-02-03 17:05:39 +01:00
switchdev switchdev: Execute bridge ndos only for bridge ports 2016-10-19 10:58:04 -04:00
tipc tipc: fix tipc_mon_delete() oops in tipc_enable_bearer() error path 2018-03-03 10:23:24 +01:00
unix net/unix: don't show information about sockets from other namespaces 2017-11-18 11:22:22 +01:00
vmw_vsock vsock: cancel packets when failing to connect 2017-12-25 14:23:38 +01:00
wimax net:wimax: Fix doucble word "the the" in networking.xml 2015-08-09 22:43:52 -07:00
wireless nl80211: Check for the required netlink attribute presence 2018-03-03 10:23:26 +01:00
x25 net: x25: remove null checks on arrays calling_ae and called_ae 2016-09-09 18:13:30 -07:00
xfrm xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies. 2018-02-25 11:05:49 +01:00
Kconfig strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
Makefile strparser: Stream parser for messages 2016-08-17 19:36:23 -04:00
compat.c audit: log 32-bit socketcalls 2017-10-08 10:26:06 +02:00
socket.c bpf: introduce BPF_JIT_ALWAYS_ON config 2018-01-31 12:55:56 +01:00
sysctl_net.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace 2016-10-06 09:52:23 -07:00