From 457dd59361c6411c425ece4a0fe280cbfa12ecba Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Mon, 7 Aug 2017 11:10:28 +0300 Subject: [PATCH 75/88] bpf: prevent speculative execution in eBPF interpreter CVE-2017-5753 (Spectre v1 Intel) This adds an observable speculation barrier before LD_IMM_DW and LDX_MEM_B/H/W/DW eBPF instructions during eBPF program execution in order to prevent speculative execution on out of bound BFP_MAP array indexes. This way an arbitary kernel memory is not exposed through side channel attacks. Signed-off-by: Elena Reshetova Signed-off-by: Andy Whitcroft --- kernel/bpf/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 9a1bed1f3029..4003d1c9ea46 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -33,6 +33,7 @@ #include #include +#include /* Registers */ #define BPF_R0 regs[BPF_REG_0] @@ -920,6 +921,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, DST = IMM; CONT; LD_IMM_DW: + osb(); DST = (u64) (u32) insn[0].imm | ((u64) (u32) insn[1].imm) << 32; insn++; CONT; @@ -1133,6 +1135,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, *(SIZE *)(unsigned long) (DST + insn->off) = IMM; \ CONT; \ LDX_MEM_##SIZEOP: \ + osb(); \ DST = *(SIZE *)(unsigned long) (SRC + insn->off); \ CONT; -- 2.15.1