Skip to contentSkip to conversation

nfc: af_nfc: Fix Spectre v1 vulnerability

PATCH In review Gustavo A. R. Silva 2 participants 5 messages Dec 21, 2018 – Dec 23, 2018

Subsystems (3)
Networking Network drivers NFC
lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 nfc: af_nfc: Fix Spectre v1 vulnerability

proto is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

net/nfc/af_nfc.c:42 nfc_sock_create() warn: potential spectre issue 'proto_tab' [w] (local cap)

Fix this by sanitizing proto before using it to index proto_tab.

Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 net/nfc/af_nfc.c | 2 ++
 1 file changed, 2 insertions(+)
net/nfc/af_nfc.c +2 -0
index d3e594eb36d0..256f3c57059e 100644
@@ -21,6 +21,7 @@
 
 #include <linux/nfc.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 
 #include "nfc.h"
 

@@ -37,6 +38,7 @@ static int nfc_sock_create(struct net *net, struct socket *sock, int proto,
 
 	if (proto < 0 || proto >= NFC_SOCKPROTO_MAX)
 		return -EINVAL;
+	proto = array_index_nospec(proto, NFC_SOCKPROTO_MAX);
 
 	read_lock(&proto_tab_lock);
 	if (proto_tab[proto] &&	try_module_get(proto_tab[proto]->owner)) {
Signature · 1 line
2.20.1
maintainer
#1 lore raw

From: "Gustavo A. R. Silva" <[email protected]>
Date: Fri, 21 Dec 2018 15:47:53 -0600

Quoted 9 lines

proto is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

net/nfc/af_nfc.c:42 nfc_sock_create() warn: potential spectre issue 'proto_tab' [w] (local cap)

Fix this by sanitizing proto before using it to index proto_tab.

Quoted 7 lines

Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by Gustavo A. R. Silva <[email protected]>

I'll take this directly, and queued up for -stable.

Thanks.

author
#2 lore raw
Quoted 16 lines · David Miller

From: "Gustavo A. R. Silva" <[email protected]>
Date: Fri, 21 Dec 2018 15:47:53 -0600

Quoted 13 lines

proto is indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

net/nfc/af_nfc.c:42 nfc_sock_create() warn: potential spectre issue 'proto_tab' [w] (local cap)

Fix this by sanitizing proto before using it to index proto_tab.

Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].

Quoted 6 lines
Quoted 3 lines

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by Gustavo A. R. Silva <[email protected]>

I'll take this directly, and queued up for -stable.

Dave,

I wonder if you can take this one too:

https://lore.kernel.org/lkml/20181221212229.GA32635@embeddedor/

It's pretty similar to the af_nfc one.

Thanks
--
Gustavo