Messages in this thread | | | Date | Thu, 08 Feb 2018 15:24:30 -0500 (EST) | Subject | Re: [PATCH] mpls, nospec: Sanitize array index in mpls_label_ok() | From | David Miller <> |
| |
From: Dan Williams <dan.j.williams@intel.com> Date: Wed, 07 Feb 2018 22:34:24 -0800
> mpls_label_ok() validates that the 'platform_label' array index from a > userspace netlink message payload is valid. Under speculation the > mpls_label_ok() result may not resolve in the CPU pipeline until after > the index is used to access an array element. Sanitize the index to zero > to prevent userspace-controlled arbitrary out-of-bounds speculation, a > precursor for a speculative execution side channel vulnerability. > > Cc: <stable@vger.kernel.org> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric W. Biederman <ebiederm@xmission.com> > Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Applied, thank you.
| |