mpls, nospec: Sanitize array index in mpls_label_ok()
authorDan Williams <dan.j.williams@intel.com>
Thu, 8 Feb 2018 06:34:24 +0000 (22:34 -0800)
committerDavid S. Miller <davem@davemloft.net>
Thu, 8 Feb 2018 20:24:12 +0000 (15:24 -0500)
commit3968523f855050b8195134da951b87c20bd66130
tree1bf66a780a1e70748dcbd036281015a1d510c564
parentebeeb1ad9b8adcc37c2ec21a96f39e9d35199b46
mpls, nospec: Sanitize array index in mpls_label_ok()

mpls_label_ok() validates that the 'platform_label' array index from a
userspace netlink message payload is valid. Under speculation the
mpls_label_ok() result may not resolve in the CPU pipeline until after
the index is used to access an array element. Sanitize the index to zero
to prevent userspace-controlled arbitrary out-of-bounds speculation, a
precursor for a speculative execution side channel vulnerability.

Cc: <stable@vger.kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/mpls/af_mpls.c