Commit 81774d48 authored by Elena Reshetova's avatar Elena Reshetova Committed by Kleber Sacilotto de Souza

bpf: prevent speculative execution in eBPF interpreter

CVE-2017-5753 (Spectre v1 Intel)

This adds an observable speculation barrier before LD_IMM_DW and
LDX_MEM_B/H/W/DW eBPF instructions during eBPF program
execution in order to prevent speculative execution on out
of bound BFP_MAP array indexes. This way an arbitary kernel
memory is not exposed through side channel attacks.
Signed-off-by: default avatarElena Reshetova <elena.reshetova@intel.com>
Signed-off-by: default avatarAndy Whitcroft <apw@canonical.com>
Signed-off-by: default avatarKleber Sacilotto de Souza <kleber.souza@canonical.com>
parent 1fed0ab0
......@@ -29,6 +29,7 @@
#include <linux/bpf.h>
#include <asm/unaligned.h>
#include <asm/barrier.h>
/* Registers */
#define BPF_R0 regs[BPF_REG_0]
......@@ -630,6 +631,7 @@ static unsigned int __bpf_prog_run(void *ctx, const struct bpf_insn *insn)
DST = IMM;
CONT;
LD_IMM_DW:
osb();
DST = (u64) (u32) insn[0].imm | ((u64) (u32) insn[1].imm) << 32;
insn++;
CONT;
......@@ -844,6 +846,7 @@ static unsigned int __bpf_prog_run(void *ctx, const struct bpf_insn *insn)
*(SIZE *)(unsigned long) (DST + insn->off) = IMM; \
CONT; \
LDX_MEM_##SIZEOP: \
osb(); \
DST = *(SIZE *)(unsigned long) (SRC + insn->off); \
CONT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment