Merge branch 'net-socket-Fix-potential-spectre-v1-gadgets' (6d27c6dd) · Commits · 戴 / test

Jeremy Cline says: ==================== net: socket: Fix potential spectre v1 gadgets This fixes a pair of potential spectre v1 gadgets. Note that because the speculation window is large, the policy is to stop the speculative out-of-bounds load and not worry if the attack can be completed with a dependent load or store[0]. [0] https://marc.info/?l=linux-kernel&m=152449131114778 ==================== Signed-off-by:

David S. Miller <davem@davemloft.net>

net/socket.c

+4 −1

Original line number	Diff line number	Diff line
		@@ -89,6 +89,7 @@
		#include <linux/magic.h>
		#include <linux/slab.h>
		#include <linux/xattr.h>
		#include <linux/nospec.h>

		#include <linux/uaccess.h>
		#include <asm/unistd.h>
		@@ -2522,6 +2523,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)

		if (call < 1 \|\| call > SYS_SENDMMSG)
		return -EINVAL;
		call = array_index_nospec(call, SYS_SENDMMSG + 1);

		len = nargs[call];
		if (len > sizeof(a))
		@@ -2688,7 +2690,8 @@ EXPORT_SYMBOL(sock_unregister);

		bool sock_is_registered(int family)
		{
		return family < NPROTO && rcu_access_pointer(net_families[family]);
		return family < NPROTO &&
		rcu_access_pointer(net_families[array_index_nospec(family, NPROTO)]);
		}

		static int __init sock_init(void)

Admin message