raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 10:00:17 +00:00
Code Issues Projects Releases Wiki Activity

dma-buf: heaps: Fix potential spectre v1 gadget

Browse Source 
commit 92c4cfaee6 upstream.

It appears like nr could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents
of kernel memory from being leaked to userspace via speculative
execution by using array_index_nospec.

Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Fixes: c02a81fba7 ("dma-buf: Add dma-buf heaps framework")
Cc: <stable@vger.kernel.org> # v5.6+
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
 [sumits: added fixes and cc: stable tags]
Link: https://patchwork.freedesktop.org/patch/msgid/20220129150604.3461652-1-jordy@pwning.systems
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Jordy Zomer
2022-01-29 16:06:04 +01:00
committed by Greg Kroah-Hartman
parent 30de3bc099
commit 5d40f1bdad
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/dma-buf/dma-heap.c
View File

@@ -14,6 +14,7 @@
#include <linux/xarray.h> #include <linux/xarray.h>
#include <linux/list.h> #include <linux/list.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/nospec.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include <linux/syscalls.h> #include <linux/syscalls.h>
#include <linux/dma-heap.h> #include <linux/dma-heap.h>
@@ -123,6 +124,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds)) if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
return -EINVAL; return -EINVAL;
nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));
/* Get the kernel ioctl cmd that matches */ /* Get the kernel ioctl cmd that matches */
kcmd = dma_heap_ioctl_cmds[nr]; kcmd = dma_heap_ioctl_cmds[nr];