projects
/
platform
/
kernel
/
linux-rpi.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
d50e734
)
ipv4: prevent potential spectre v1 gadget in fib_metrics_match()
author
Eric Dumazet
<edumazet@google.com>
Fri, 20 Jan 2023 13:31:40 +0000
(13:31 +0000)
committer
Greg Kroah-Hartman
<gregkh@linuxfoundation.org>
Wed, 1 Feb 2023 07:27:27 +0000
(08:27 +0100)
[ Upstream commit
5e9398a26a92fc402d82ce1f97cc67d832527da0
]
if (!type)
continue;
if (type > RTAX_MAX)
return false;
...
fi_val = fi->fib_metrics->metrics[type - 1];
@type being used as an array index, we need to prevent
cpu speculation or risk leaking kernel memory content.
Fixes:
5f9ae3d9e7e4
("ipv4: do metrics match when looking up and deleting a route")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link:
https://lore.kernel.org/r/20230120133140.3624204-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
net/ipv4/fib_semantics.c
patch
|
blob
|
history
diff --git
a/net/ipv4/fib_semantics.c
b/net/ipv4/fib_semantics.c
index
250af6e
..
607a4f8
100644
(file)
--- a/
net/ipv4/fib_semantics.c
+++ b/
net/ipv4/fib_semantics.c
@@
-30,6
+30,7
@@
#include <linux/slab.h>
#include <linux/netlink.h>
#include <linux/hash.h>
+#include <linux/nospec.h>
#include <net/arp.h>
#include <net/ip.h>
@@
-1020,6
+1021,7
@@
bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
if (type > RTAX_MAX)
return false;
+ type = array_index_nospec(type, RTAX_MAX + 1);
if (type == RTAX_CC_ALGO) {
char tmp[TCP_CA_NAME_MAX];
bool ecn_ca = false;