releases/4.4.170/ip6mr-fix-potential-spectre-v1-vulnerability.patch

   1 From foo@baz Fri Jan  4 19:53:50 CET 2019
   2 From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
   3 Date: Tue, 11 Dec 2018 14:10:08 -0600
   4 Subject: ip6mr: Fix potential Spectre v1 vulnerability
   5
   6 From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
   7
   8 [ Upstream commit 69d2c86766da2ded2b70281f1bf242cb0d58a778 ]
   9
  10 vr.mifi is indirectly controlled by user-space, hence leading to
  11 a potential exploitation of the Spectre variant 1 vulnerability.
  12
  13 This issue was detected with the help of Smatch:
  14
  15 net/ipv6/ip6mr.c:1845 ip6mr_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
  16 net/ipv6/ip6mr.c:1919 ip6mr_compat_ioctl() warn: potential spectre issue 'mrt->vif_table' [r] (local cap)
  17
  18 Fix this by sanitizing vr.mifi before using it to index mrt->vif_table'
  19
  20 Notice that given that speculation windows are large, the policy is
  21 to kill the speculation on the first load and not worry if it can be
  22 completed with a dependent load/store [1].
  23
  24 [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
  25
  26 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
  27 Signed-off-by: David S. Miller <davem@davemloft.net>
  28 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  29 ---
  30  net/ipv6/ip6mr.c |    4 ++++
  31  1 file changed, 4 insertions(+)
  32
  33 --- a/net/ipv6/ip6mr.c
  34 +++ b/net/ipv6/ip6mr.c
  35 @@ -72,6 +72,8 @@ struct mr6_table {
  36  #endif
  37  };
  38
  39 +#include <linux/nospec.h>
  40 +
  41  struct ip6mr_rule {
  42         struct fib_rule         common;
  43  };
  44 @@ -1871,6 +1873,7 @@ int ip6mr_ioctl(struct sock *sk, int cmd
  45                         return -EFAULT;
  46                 if (vr.mifi >= mrt->maxvif)
  47                         return -EINVAL;
  48 +               vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
  49                 read_lock(&mrt_lock);
  50                 vif = &mrt->vif6_table[vr.mifi];
  51                 if (MIF_EXISTS(mrt, vr.mifi)) {
  52 @@ -1945,6 +1948,7 @@ int ip6mr_compat_ioctl(struct sock *sk,
  53                         return -EFAULT;
  54                 if (vr.mifi >= mrt->maxvif)
  55                         return -EINVAL;
  56 +               vr.mifi = array_index_nospec(vr.mifi, mrt->maxvif);
  57                 read_lock(&mrt_lock);
  58                 vif = &mrt->vif6_table[vr.mifi];
  59                 if (MIF_EXISTS(mrt, vr.mifi)) {