| Message ID | 20230120133140.3624204-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 5e9398a26a92fc402d82ce1f97cc67d832527da0 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ipv4: prevent potential spectre v1 gadget in fib_metrics_match() | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 20 Jan 2023 13:31:40 +0000 you wrote: > if (!type) > continue; > if (type > RTAX_MAX) > return false; > ... > fi_val = fi->fib_metrics->metrics[type - 1]; > > [...] Here is the summary with links: - [net] ipv4: prevent potential spectre v1 gadget in fib_metrics_match() https://git.kernel.org/netdev/net/c/5e9398a26a92 You are awesome, thank you!
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c index ce9ff3c62e84055393ca1ff98f1d2ae391978638..3bb890a40ed73626acba8c22044d1c5f99c872e8 100644 --- a/net/ipv4/fib_semantics.c +++ b/net/ipv4/fib_semantics.c @@ -30,6 +30,7 @@ #include <linux/slab.h> #include <linux/netlink.h> #include <linux/hash.h> +#include <linux/nospec.h> #include <net/arp.h> #include <net/inet_dscp.h> @@ -1022,6 +1023,7 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi) if (type > RTAX_MAX) return false; + type = array_index_nospec(type, RTAX_MAX + 1); if (type == RTAX_CC_ALGO) { char tmp[TCP_CA_NAME_MAX]; bool ecn_ca = false;
if (!type) continue; if (type > RTAX_MAX) return false; ... fi_val = fi->fib_metrics->metrics[type - 1]; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 5f9ae3d9e7e4 ("ipv4: do metrics match when looking up and deleting a route") Signed-off-by: Eric Dumazet <edumazet@google.com> --- net/ipv4/fib_semantics.c | 2 ++ 1 file changed, 2 insertions(+)