• Jeremy Cline's avatar
    netlink: Fix spectre v1 gadget in netlink_create() · bc5b6c0b
    Jeremy Cline authored
    'protocol' is a user-controlled value, so sanitize it after the bounds
    check to avoid using it for speculative out-of-bounds access to arrays
    indexed by it.
    
    This addresses the following accesses detected with the help of smatch:
    
    * net/netlink/af_netlink.c:654 __netlink_create() warn: potential
      spectre issue 'nlk_cb_mutex_keys' [w]
    
    * net/netlink/af_netlink.c:654 __netlink_create() warn: potential
      spectre issue 'nlk_cb_mutex_key_strings' [w]
    
    * net/netlink/af_netlink.c:685 netlink_create() warn: potential spectre
      issue 'nl_table' [w] (local cap)
    
    Cc: Josh Poimboeuf <jpoimboe@redhat.com>
    Signed-off-by: default avatarJeremy Cline <jcline@redhat.com>
    Reviewed-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    bc5b6c0b
af_netlink.c 64.7 KB