Dan Williams 3968523f85 mpls, nospec: Sanitize array index in mpls_label_ok() ...

mpls_label_ok() validates that the 'platform_label' array index from a
userspace netlink message payload is valid. Under speculation the
mpls_label_ok() result may not resolve in the CPU pipeline until after
the index is used to access an array element. Sanitize the index to zero
to prevent userspace-controlled arbitrary out-of-bounds speculation, a
precursor for a speculative execution side channel vulnerability.

Cc: <stable@vger.kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2018-02-08 15:24:12 -05:00

..

af_mpls.c

mpls, nospec: Sanitize array index in mpls_label_ok()

2018-02-08 15:24:12 -05:00

internal.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

Kconfig

ip_tunnel: fix building with NET_IP_TUNNEL=m

2017-10-12 12:21:11 -07:00

Makefile

mpls: ip tunnel support

2015-07-21 10:39:05 -07:00

mpls_gso.c

net: mpls: Fixups for GSO

2016-08-30 22:27:18 -07:00

mpls_iptunnel.c

net: Fill in extack for mpls lwt encap

2017-05-30 11:55:32 -04:00