Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6d27c6dd authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'net-socket-Fix-potential-spectre-v1-gadgets' 

Jeremy Cline says:

====================
net: socket: Fix potential spectre v1 gadgets

This fixes a pair of potential spectre v1 gadgets.

Note that because the speculation window is large, the policy is to stop
the speculative out-of-bounds load and not worry if the attack can be
completed with a dependent load or store[0].

[0] https://marc.info/?l=linux-kernel&m=152449131114778


====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 958b4cd8 e978de7a

net/socket.c

+4 −1
Original line number Diff line number Diff line
@@ -89,6 +89,7 @@ 
#include <linux/magic.h>

#include <linux/slab.h>

#include <linux/xattr.h>

#include <linux/nospec.h>



#include <linux/uaccess.h>

#include <asm/unistd.h>
@@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) 


	if (call < 1 || call > SYS_SENDMMSG)

		return -EINVAL;

	call = array_index_nospec(call, SYS_SENDMMSG + 1);



	len = nargs[call];

	if (len > sizeof(a))
@@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister); 


bool sock_is_registered(int family)

{

	return family < NPROTO && rcu_access_pointer(net_families[family]);

	return family < NPROTO &&

		rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);

}



static int __init sock_init(void)