p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge branch 'net-socket-Fix-potential-spectre-v1-gadgets' 

Jeremy Cline says:

====================
net: socket: Fix potential spectre v1 gadgets

This fixes a pair of potential spectre v1 gadgets.

Note that because the speculation window is large, the policy is to stop
the speculative out-of-bounds load and not worry if the attack can be
completed with a dependent load or store[0].

[0] https://marc.info/?l=linux-kernel&m=152449131114778
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
David S. Miller 2018-07-28 22:43:31 -07:00
parent 958b4cd8fa e978de7a6d
commit 6d27c6dd10
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
net/socket.c
View File

@ -89,6 +89,7 @@
#include <linux/magic.h> #include <linux/magic.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/xattr.h> #include <linux/xattr.h>
#include <linux/nospec.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include <asm/unistd.h> #include <asm/unistd.h>
@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
if (call < 1 || call > SYS_SENDMMSG) if (call < 1 || call > SYS_SENDMMSG)
return -EINVAL; return -EINVAL;
call = array_index_nospec(call, SYS_SENDMMSG + 1);
len = nargs[call]; len = nargs[call];
if (len > sizeof(a)) if (len > sizeof(a))
@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);
bool sock_is_registered(int family) bool sock_is_registered(int family)
{ {
return family < NPROTO && rcu_access_pointer(net_families[family]); return family < NPROTO &&
rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
} }
static int __init sock_init(void) static int __init sock_init(void)