Re: [PATCH net v2] ipv4: fib_trie: prevent speculative out-of-bounds child access

[Eric Dumazet]

Le sam. 10 oct. 2026 à 07:37, Daniël Trujillo via B4 Relay
<devnull+datrujillo.nvidia.com@xxxxxxxxxx> a écrit :
>
> From: Daniël Trujillo <datrujillo@xxxxxxxxxx>
>
> fib_table_lookup() checks the child index against the bounds before
> passing it to get_child_rcu().
>
> The index is derived from the lookup key, which in turn is derived from
> flp->daddr. A userspace process can therefore influence the index by
> triggering lookups for chosen destination IPv4 addresses.
>
> If this bounds check is mispredicted as in-bounds, an out-of-bounds index
> can be transiently passed to get_child_rcu(). The value loaded beyond the
> child array is then treated as a node pointer. A later transient
> dereference of that pointer can cause a data-dependent cache footprint.
>
> This was found during Spectre-v1 research. Leakage was demonstrated with
> instrumentation that delays branch resolution with a CLFLUSH before the
> mispredicted branch and makes the leaked location
> deterministic for reproducible measurement. In that setup, a
> userspace-controlled IPv4 lookup key was able to trigger a transient
> out-of-bounds child access. The transient use of the loaded value as a
> pointer caused a data-dependent cache footprint that was recoverable from
> userspace using Prime+Probe. A real-world attacker would likely
> need to delay branch resolution, which was not demonstrated end-to-end
> without the added CLFLUSH.
>
> Sanitize the index with array_index_nospec() before accessing the child
> array. This removed the observed leakage in the described setup.
>
> Apply the hardening before setting cindex in fib_table_lookup(), because
> cindex can later be used by the backtrace path to load another child
> pointer. fib_find_node() has the same pattern, with the checked index
> derived from a user-provided key in fib_table_insert() and
> fib_table_delete(). leaf_walk_rcu() has a similar checked cindex before
> get_child_rcu(), and the traversed state can be influenced by userspace
> actions. fib_find_node() runs under RTNL and
> leaf_walk_rcu() is not on the packet lookup hot path, so harden those
> analogous accesses in the same way.
>
> Fixes: 9f9e636d4f89 ("fib_trie: Optimize fib_table_lookup to avoid wasting time on loops/variables")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Daniël Trujillo <datrujillo@xxxxxxxxxx>
> ---
> Changes in v2:
> - Move array_index_nospec() before cindex is set in
>   fib_table_lookup() so the backtrace path cannot use an out-of-bounds index
>   (Eric Dumazet).
> - Apply the same hardening to fib_find_node() and leaf_walk_rcu()
>   (Eric Dumazet).
> - Add discovery/testing details of the gadget to the changelog.
> - Link to v1: https://patch.msgid.link/20261008-fib-trie-nospec-v1-1-fa18726d485e@xxxxxxxxxx
>

This looks good to me, let's wait for final Sashiko findings.

Choice of net vs net-next tree is also debatable given that
performance impacts are unknown.

Thanks.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>