This is a note to let you know that I've just added the patch titled
prlimit: do_prlimit needs to have a speculation check
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
prlimit-do_prlimit-needs-to-have-a-speculation-check.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Jan 2023 11:03:20 +0100
Subject: prlimit: do_prlimit needs to have a speculation check
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream.
do_prlimit() adds the user-controlled resource value to a pointer that
will subsequently be dereferenced. In order to help prevent this
codepath from being used as a spectre "gadget" a barrier needs to be
added after checking the range.
Reported-by: Jordy Zomer <jordyzomer@xxxxxxxxxx>
Tested-by: Jordy Zomer <jordyzomer@xxxxxxxxxx>
Suggested-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/sys.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1472,6 +1472,8 @@ int do_prlimit(struct task_struct *tsk,
if (resource >= RLIM_NLIMITS)
return -EINVAL;
+ resource = array_index_nospec(resource, RLIM_NLIMITS);
+
if (new_rlim) {
if (new_rlim->rlim_cur > new_rlim->rlim_max)
return -EINVAL;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-4.14/usb-serial-option-add-quectel-em05cn-modem.patch
queue-4.14/usb-serial-option-add-quectel-em05-g-rs-modem.patch
queue-4.14/usb-serial-option-add-quectel-em05-g-cs-modem.patch
queue-4.14/nilfs2-fix-general-protection-fault-in-nilfs_btree_insert.patch
queue-4.14/xhci-pci-set-the-dma-max_seg_size.patch
queue-4.14/usb-serial-option-add-quectel-ec200u-modem.patch
queue-4.14/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch
queue-4.14/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch
queue-4.14/usb-serial-option-add-quectel-em05-g-gr-modem.patch
queue-4.14/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch
queue-4.14/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch
queue-4.14/usb-serial-option-add-quectel-em05cn-sg-modem.patch
