lkml.org 
[lkml]   [2018]   [Feb]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.15 126/163] mpls, nospec: Sanitize array index in mpls_label_ok()
    Date
    4.15-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Dan Williams <dan.j.williams@intel.com>

    commit 3968523f855050b8195134da951b87c20bd66130 upstream.

    mpls_label_ok() validates that the 'platform_label' array index from a
    userspace netlink message payload is valid. Under speculation the
    mpls_label_ok() result may not resolve in the CPU pipeline until after
    the index is used to access an array element. Sanitize the index to zero
    to prevent userspace-controlled arbitrary out-of-bounds speculation, a
    precursor for a speculative execution side channel vulnerability.

    Cc: <stable@vger.kernel.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Eric W. Biederman <ebiederm@xmission.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/mpls/af_mpls.c | 24 ++++++++++++++----------
    1 file changed, 14 insertions(+), 10 deletions(-)

    --- a/net/mpls/af_mpls.c
    +++ b/net/mpls/af_mpls.c
    @@ -8,6 +8,7 @@
    #include <linux/ipv6.h>
    #include <linux/mpls.h>
    #include <linux/netconf.h>
    +#include <linux/nospec.h>
    #include <linux/vmalloc.h>
    #include <linux/percpu.h>
    #include <net/ip.h>
    @@ -935,24 +936,27 @@ errout:
    return err;
    }

    -static bool mpls_label_ok(struct net *net, unsigned int index,
    +static bool mpls_label_ok(struct net *net, unsigned int *index,
    struct netlink_ext_ack *extack)
    {
    + bool is_ok = true;
    +
    /* Reserved labels may not be set */
    - if (index < MPLS_LABEL_FIRST_UNRESERVED) {
    + if (*index < MPLS_LABEL_FIRST_UNRESERVED) {
    NL_SET_ERR_MSG(extack,
    "Invalid label - must be MPLS_LABEL_FIRST_UNRESERVED or higher");
    - return false;
    + is_ok = false;
    }

    /* The full 20 bit range may not be supported. */
    - if (index >= net->mpls.platform_labels) {
    + if (is_ok && *index >= net->mpls.platform_labels) {
    NL_SET_ERR_MSG(extack,
    "Label >= configured maximum in platform_labels");
    - return false;
    + is_ok = false;
    }

    - return true;
    + *index = array_index_nospec(*index, net->mpls.platform_labels);
    + return is_ok;
    }

    static int mpls_route_add(struct mpls_route_config *cfg,
    @@ -975,7 +979,7 @@ static int mpls_route_add(struct mpls_ro
    index = find_free_label(net);
    }

    - if (!mpls_label_ok(net, index, extack))
    + if (!mpls_label_ok(net, &index, extack))
    goto errout;

    /* Append makes no sense with mpls */
    @@ -1052,7 +1056,7 @@ static int mpls_route_del(struct mpls_ro

    index = cfg->rc_label;

    - if (!mpls_label_ok(net, index, extack))
    + if (!mpls_label_ok(net, &index, extack))
    goto errout;

    mpls_route_update(net, index, NULL, &cfg->rc_nlinfo);
    @@ -1810,7 +1814,7 @@ static int rtm_to_route_config(struct sk
    goto errout;

    if (!mpls_label_ok(cfg->rc_nlinfo.nl_net,
    - cfg->rc_label, extack))
    + &cfg->rc_label, extack))
    goto errout;
    break;
    }
    @@ -2137,7 +2141,7 @@ static int mpls_getroute(struct sk_buff
    goto errout;
    }

    - if (!mpls_label_ok(net, in_label, extack)) {
    + if (!mpls_label_ok(net, &in_label, extack)) {
    err = -EINVAL;
    goto errout;
    }

    \
     
     \ /
      Last update: 2018-02-21 14:25    [W:4.073 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site