From 83515cfdfd071d4c6e940cae038ec93f3f672f35 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 02:35:57 -0800 Subject: [PATCH] udf: prevent speculative execution Since the eahd->appAttrLocation value in function udf_add_extendedattr() seems to be controllable by userspace and later on conditionally (upon bound check) used in following memmove, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- fs/udf/misc.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/udf/misc.c b/fs/udf/misc.c index 71d1c25f360d..aee498e52b7b 100644 --- a/fs/udf/misc.c +++ b/fs/udf/misc.c @@ -104,6 +104,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; @@ -114,6 +116,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t ial = le32_to_cpu(eahd->impAttrLocation); + + osb(); memmove(&ea[offset - ial + size], &ea[ial], offset - ial); offset -= ial; @@ -125,6 +129,8 @@ struct genericFormat *udf_add_extendedattr(struct inode *inode, uint32_t size, iinfo->i_lenEAttr) { uint32_t aal = le32_to_cpu(eahd->appAttrLocation); + + osb(); memmove(&ea[offset - aal + size], &ea[aal], offset - aal); offset -= aal; -- 2.50.1