| Message ID | 20230120133040.3623463-1-edumazet@google.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 1d1d63b612801b3f0a39b7d4467cad0abd60e5c8 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() | expand |
Hello: This patch was applied to netdev/net.git (master) by Jakub Kicinski <kuba@kernel.org>: On Fri, 20 Jan 2023 13:30:40 +0000 you wrote: > if (!type) > continue; > if (type > RTAX_MAX) > return -EINVAL; > ... > metrics[type - 1] = val; > > [...] Here is the summary with links: - [net] ipv4: prevent potential spectre v1 gadget in ip_metrics_convert() https://git.kernel.org/netdev/net/c/1d1d63b61280 You are awesome, thank you!
diff --git a/net/ipv4/metrics.c b/net/ipv4/metrics.c index 7fcfdfd8f9def057cbe163b8b395cd2379d98152..0e3ee1532848c8f49e0a342b7c8ecc1c27684e67 100644 --- a/net/ipv4/metrics.c +++ b/net/ipv4/metrics.c @@ -1,5 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only #include <linux/netlink.h> +#include <linux/nospec.h> #include <linux/rtnetlink.h> #include <linux/types.h> #include <net/ip.h> @@ -25,6 +26,7 @@ static int ip_metrics_convert(struct net *net, struct nlattr *fc_mx, return -EINVAL; } + type = array_index_nospec(type, RTAX_MAX + 1); if (type == RTAX_CC_ALGO) { char tmp[TCP_CA_NAME_MAX];
if (!type) continue; if (type > RTAX_MAX) return -EINVAL; ... metrics[type - 1] = val; @type being used as an array index, we need to prevent cpu speculation or risk leaking kernel memory content. Fixes: 6cf9dfd3bd62 ("net: fib: move metrics parsing to a helper") Signed-off-by: Eric Dumazet <edumazet@google.com> --- net/ipv4/metrics.c | 2 ++ 1 file changed, 2 insertions(+)