linux/net/mpls
Dan Williams 3968523f85 mpls, nospec: Sanitize array index in mpls_label_ok()
mpls_label_ok() validates that the 'platform_label' array index from a
userspace netlink message payload is valid. Under speculation the
mpls_label_ok() result may not resolve in the CPU pipeline until after
the index is used to access an array element. Sanitize the index to zero
to prevent userspace-controlled arbitrary out-of-bounds speculation, a
precursor for a speculative execution side channel vulnerability.

Cc: <stable@vger.kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-02-08 15:24:12 -05:00
..
af_mpls.c mpls, nospec: Sanitize array index in mpls_label_ok() 2018-02-08 15:24:12 -05:00
internal.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Kconfig ip_tunnel: fix building with NET_IP_TUNNEL=m 2017-10-12 12:21:11 -07:00
Makefile mpls: ip tunnel support 2015-07-21 10:39:05 -07:00
mpls_gso.c net: mpls: Fixups for GSO 2016-08-30 22:27:18 -07:00
mpls_iptunnel.c net: Fill in extack for mpls lwt encap 2017-05-30 11:55:32 -04:00