From 09c25f0f0d5043430a2862a88eead0ef73e96014 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Wed, 13 Dec 2017 10:15:30 +0200 Subject: [PATCH 89/98] udf: prevent speculative execution CVE-2017-5753 (Spectre v1 Intel) Since the eahd->appAttrLocation value in function udf_add_extendedattr() seems to be controllable by userspace and later on conditionally (upon bound check) used in following memmove, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Signed-off-by: Andy Whitcroft --- fs/udf/misc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/udf/misc.c b/fs/udf/misc.c index 3949c4bec3a3..c826ccc7ceae 100644 --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; @@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t ial = le32_to_cpu(eahd->impAttrLocation); + + osb(); memmove(&ea[offset - ial + size], &ea[ial], offset - ial); offset -= ial; @@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; -- 2.15.1