| Subject | Re: [PATCH 16/18] net: mpls: prevent bounds-check bypass via speculative execution | From | Sergei Shtylyov <> | Date | Sat, 6 Jan 2018 13:06:28 +0300 |
| |
On 1/6/2018 4:11 AM, Dan Williams wrote:
> Static analysis reports that 'index' may be a user controlled value that > is used as a data dependency reading 'rt' from the 'platform_label' > array. In order to avoid potential leaks of kernel memory values, block > speculative execution of the instruction stream that could issue further > reads based on an invalid 'rt' value. > > Based on an original patch by Elena Reshetova. > > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric W. Biederman <ebiederm@xmission.com> > Cc: netdev@vger.kernel.org > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> > Signed-off-by: Dan Williams <dan.j.williams@intel.com> > --- > net/mpls/af_mpls.c | 12 +++++++----- > 1 file changed, 7 insertions(+), 5 deletions(-) > > diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c > index 8ca9915befc8..ebcf0e246cfe 100644 > --- a/net/mpls/af_mpls.c > +++ b/net/mpls/af_mpls.c [...] > @@ -77,12 +78,13 @@ static void rtmsg_lfib(int event, u32 label, struct mpls_route *rt, > static struct mpls_route *mpls_route_input_rcu(struct net *net, unsigned index) > { > struct mpls_route *rt = NULL; > + struct mpls_route __rcu **platform_label = > + rcu_dereference(net->mpls.platform_label); > + struct mpls_route __rcu **rtp; > > - if (index < net->mpls.platform_labels) { > - struct mpls_route __rcu **platform_label = > - rcu_dereference(net->mpls.platform_label); > - rt = rcu_dereference(platform_label[index]); > - } > + if ((rtp = nospec_array_ptr(platform_label, index,
And here...
> + net->mpls.platform_labels))) > + rt = rcu_dereference(*rtp); > return rt; > } >
MBR, Sergei
|