From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Josh Poimboeuf <jpoimboe@redhat.com>,
Jeremy Cline <jcline@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.17 05/31] netlink: Fix spectre v1 gadget in netlink_create()
Date: Sat, 4 Aug 2018 11:00:40 +0200 [thread overview]
Message-ID: <20180804082632.678922895@linuxfoundation.org> (raw)
In-Reply-To: <20180804082632.304529527@linuxfoundation.org>
4.17-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Cline <jcline@redhat.com>
[ Upstream commit bc5b6c0b62b932626a135f516a41838c510c6eba ]
'protocol' is a user-controlled value, so sanitize it after the bounds
check to avoid using it for speculative out-of-bounds access to arrays
indexed by it.
This addresses the following accesses detected with the help of smatch:
* net/netlink/af_netlink.c:654 __netlink_create() warn: potential
spectre issue 'nlk_cb_mutex_keys' [w]
* net/netlink/af_netlink.c:654 __netlink_create() warn: potential
spectre issue 'nlk_cb_mutex_key_strings' [w]
* net/netlink/af_netlink.c:685 netlink_create() warn: potential spectre
issue 'nl_table' [w] (local cap)
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: Jeremy Cline <jcline@redhat.com>
Reviewed-by: Josh Poimboeuf <jpoimboe@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netlink/af_netlink.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
#include <linux/hash.h>
#include <linux/genetlink.h>
#include <linux/net_namespace.h>
+#include <linux/nospec.h>
#include <net/net_namespace.h>
#include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *ne
if (protocol < 0 || protocol >= MAX_LINKS)
return -EPROTONOSUPPORT;
+ protocol = array_index_nospec(protocol, MAX_LINKS);
netlink_lock_table();
#ifdef CONFIG_MODULES
next prev parent reply other threads:[~2018-08-04 9:02 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-04 9:00 [PATCH 4.17 00/31] 4.17.13-stable review Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 01/31] bonding: avoid lockdep confusion in bond_get_stats() Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 02/31] inet: frag: enforce memory limits earlier Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 03/31] ipv4: frags: handle possible skb truesize change Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 04/31] net: dsa: Do not suspend/resume closed slave_dev Greg Kroah-Hartman
2018-08-04 9:00 ` Greg Kroah-Hartman [this message]
2018-08-04 9:00 ` [PATCH 4.17 06/31] net: stmmac: Fix WoL for PCI-based setups Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 07/31] rxrpc: Fix user call ID check in rxrpc_service_prealloc_one Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 08/31] net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 09/31] net/mlx5e: Set port trust mode to PCP as default Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 10/31] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 11/31] squashfs: more metadata hardening Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 13/31] can: ems_usb: Fix memory leak on ems_usb_disconnect() Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 14/31] net: socket: fix potential spectre v1 gadget in socketcall Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 15/31] net: socket: Fix potential spectre v1 gadget in sock_is_registered Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 16/31] virtio_balloon: fix another race between migration and ballooning Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 17/31] x86/efi: Access EFI MMIO data as unencrypted when SEV is active Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 18/31] x86/apic: Future-proof the TSC_DEADLINE quirk for SKX Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 19/31] x86/entry/64: Remove %ebx handling from error_entry/exit Greg Kroah-Hartman
2018-08-04 9:00 ` Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 20/31] kvm: x86: vmx: fix vpid leak Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 21/31] audit: fix potential null dereference context->module.name Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 23/31] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails Greg Kroah-Hartman
2018-08-04 9:00 ` [PATCH 4.17 24/31] iwlwifi: add more card IDs for 9000 series Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 26/31] RDMA/uverbs: Expand primary and alt AV port checks Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 27/31] crypto: padlock-aes - Fix Nano workaround data corruption Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 28/31] drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 29/31] drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check() Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 30/31] drm/atomic: Initialize variables in drm_atomic_helper_async_check() to make gcc happy Greg Kroah-Hartman
2018-08-04 9:01 ` [PATCH 4.17 31/31] scsi: sg: fix minor memory leak in error path Greg Kroah-Hartman
2018-08-04 14:49 ` [PATCH 4.17 00/31] 4.17.13-stable review Guenter Roeck
2018-08-05 6:54 ` Greg Kroah-Hartman
2018-08-05 11:50 ` Naresh Kamboju
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180804082632.678922895@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=jcline@redhat.com \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.