From acc08dc457b9c6b30c21f589ef4f2f5235d1e654 Mon Sep 17 00:00:00 2001 From: Elena Reshetova <elena.reshetova@intel.com> Date: Mon, 7 Aug 2017 11:10:28 +0300 Subject: [PATCH 142/194] bpf: prevent speculative execution in eBPF interpreter This adds an observable speculation barrier before LD_IMM_DW and LDX_MEM_B/H/W/DW eBPF instructions during eBPF program execution in order to prevent speculative execution on out of bound BFP_MAP array indexes. This way an arbitary kernel memory is not exposed through side channel attacks. Signed-off-by: Elena Reshetova <elena.reshetova@intel.com> --- kernel/bpf/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 7b62df8..b28eca1 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -33,6 +33,7 @@ #include <linux/frame.h> #include <asm/unaligned.h> +#include <asm/barrier.h> /* Registers */ #define BPF_R0 regs[BPF_REG_0] @@ -932,6 +933,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, DST = IMM; CONT; LD_IMM_DW: + osb(); DST = (u64) (u32) insn[0].imm | ((u64) (u32) insn[1].imm) << 32; insn++; CONT; @@ -1193,6 +1195,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, *(SIZE *)(unsigned long) (DST + insn->off) = IMM; \ CONT; \ LDX_MEM_##SIZEOP: \ + osb(); \ DST = *(SIZE *)(unsigned long) (SRC + insn->off); \ CONT; -- 2.9.5