4.9-stable review patch.  If anyone has any objections, please let me know.


From: Dan Williams <dan.j.willi...@intel.com>

(cherry picked from commit 2fbd7af5af8665d18bcefae3e9700be07e22b681)

The syscall table base is a user controlled function pointer in kernel
space. Use array_index_nospec() to prevent any out of bounds speculation.

While retpoline prevents speculating into a userspace directed target it
does not stop the pointer de-reference, the concern is leaking memory
relative to the syscall table base, by observing instruction cache

Reported-by: Linus Torvalds <torva...@linux-foundation.org>
Signed-off-by: Dan Williams <dan.j.willi...@intel.com>
Signed-off-by: Thomas Gleixner <t...@linutronix.de>
Cc: linux-a...@vger.kernel.org
Cc: kernel-harden...@lists.openwall.com
Cc: gre...@linuxfoundation.org
Cc: Andy Lutomirski <l...@kernel.org>
Cc: a...@linux.intel.com
Signed-off-by: David Woodhouse <d...@amazon.co.uk>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
 arch/x86/entry/common.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

--- a/arch/x86/entry/common.c
+++ b/arch/x86/entry/common.c
@@ -20,6 +20,7 @@
 #include <linux/export.h>
 #include <linux/context_tracking.h>
 #include <linux/user-return-notifier.h>
+#include <linux/nospec.h>
 #include <linux/uprobes.h>
 #include <asm/desc.h>
@@ -277,7 +278,8 @@ __visible void do_syscall_64(struct pt_r
         * regs->orig_ax, which changes the behavior of some syscalls.
        if (likely((nr & __SYSCALL_MASK) < NR_syscalls)) {
-               regs->ax = sys_call_table[nr & __SYSCALL_MASK](
+               nr = array_index_nospec(nr & __SYSCALL_MASK, NR_syscalls);
+               regs->ax = sys_call_table[nr](
                        regs->di, regs->si, regs->dx,
                        regs->r10, regs->r8, regs->r9);
@@ -313,6 +315,7 @@ static __always_inline void do_syscall_3
        if (likely(nr < IA32_NR_syscalls)) {
+               nr = array_index_nospec(nr, IA32_NR_syscalls);
                 * It's possible that a 32-bit syscall implementation
                 * takes a 64-bit parameter but nonetheless assumes that

Reply via email to