Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81b8eb6b authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Greg Kroah-Hartman
Browse files

net: atm: Fix potential Spectre v1 

commit acf784bd0ce257fe43da7ca266f7a10b837479d2 upstream.

ioc_data.dev_num can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:
net/atm/lec.c:702 lec_vcc_attach() warn: potential spectre issue
'dev_lec'

Fix this by sanitizing ioc_data.dev_num before using it to index
dev_lec. Also, notice that there is another instance in which array
dev_lec is being indexed using ioc_data.dev_num at line 705:
lec_vcc_added(netdev_priv(dev_lec[ioc_data.dev_num]),

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2



Cc: stable@vger.kernel.org
Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 28d832be

net/atm/lec.c

+7 −2
Original line number Diff line number Diff line
@@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 }; 
#include <linux/module.h>

#include <linux/init.h>



/* Hardening for Spectre-v1 */

#include <linux/nospec.h>



#include "lec.h"

#include "lec_arpc.h"

#include "resources.h"
@@ -697,8 +700,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) 
	bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc));

	if (bytes_left != 0)

		pr_info("copy from user failed for %d bytes\n", bytes_left);

	if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF ||

	    !dev_lec[ioc_data.dev_num])

	if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF)

		return -EINVAL;

	ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF);

	if (!dev_lec[ioc_data.dev_num])

		return -EINVAL;

	vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL);

	if (!vpriv)