From bbb72371d2212fe0526f1ae679d5d55fe51bd909 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Wed, 13 Dec 2017 10:15:30 +0200 Subject: [PATCH 154/194] udf: prevent speculative execution Since the eahd->appAttrLocation value in function udf_add_extendedattr() seems to be controllable by userspace and later on conditionally (upon bound check) used in following memmove, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova --- fs/udf/misc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/udf/misc.c b/fs/udf/misc.c index 3949c4b..c826ccc 100644 --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; @@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t ial = le32_to_cpu(eahd->impAttrLocation); + + osb(); memmove(&ea[offset - ial + size], &ea[ial], offset - ial); offset -= ial; @@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; -- 2.9.5