Gustavo A. R. Silva 4be809db21 char/mwave: fix potential Spectre v1 vulnerability ...

commit 701956d401 upstream.

ipcnum is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/char/mwave/mwavedd.c:299 mwave_ioctl() warn: potential spectre issue 'pDrvData->IPCs' [w] (local cap)

Fix this by sanitizing ipcnum before using it to index pDrvData->IPCs.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2019-01-31 08:13:43 +01:00

..

agp

agp: uninorth: make two functions static

2018-06-21 04:02:56 +09:00

hw_random

hwrng: stm32 - add reset during probe

2018-05-30 07:52:36 +02:00

ipmi

ipmi:ssif: Fix handling of multi-part return messages

2019-01-26 09:37:07 +01:00

mwave

char/mwave: fix potential Spectre v1 vulnerability

2019-01-31 08:13:43 +01:00

pcmcia

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tpm

tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x

2019-01-09 17:14:53 +01:00

xilinx_hwicap

char: xilinx_hwicap: Fix warnings in the driver

2017-08-28 17:04:47 +02:00

xillybus

char: xillybus: Fix spelling mistake and comment

2016-08-31 14:47:54 +02:00

apm-emulation.c

apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h

2017-01-10 21:46:41 +01:00

applicom.c

applicom: constify pci_device_id.

2017-08-28 17:11:28 +02:00

applicom.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

bfin-otp.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

bsr.c

bsr: avoid format string leaking into device name

2014-07-09 16:59:15 -07:00

ds1302.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

ds1620.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

dsp56k.c

format-security: move static strings to const

2017-05-08 17:15:14 -07:00

dtlk.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

efirtc.c

drivers/char: make efirtc.c driver explicitly non-modular

2015-09-20 19:32:35 -07:00

generic_nvram.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

hangcheck-timer.c

hangcheck-timer: Fix typo in comment

2017-04-08 18:08:54 +02:00

hpet.c

hpet: Make cmd parameter of hpet_ioctl_common() unsigned

2017-03-17 15:10:49 +09:00

Kconfig

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

lp.c

char: lp: fix possible integer overflow in lp_setup()

2017-05-16 23:05:20 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mbcs.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

mbcs.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

mem.c

/dev/mem: Avoid overwriting "err" in read_mem()

2018-04-08 14:26:31 +02:00

misc.c

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

mspec.c

drivers, char: convert vma_data.refcnt from atomic_t to refcount_t

2017-03-23 13:57:19 +01:00

nsc_gpio.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

nvram.c

char/nvram: set array of const as const

2016-02-08 14:57:30 -08:00

nwbutton.c

drivers/char/nwbutton: Fix build breakage caused by include file reshuffling

2017-03-07 08:35:49 +01:00

nwbutton.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

nwflash.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

pc8736x_gpio.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

powernv-op-panel.c

powerpc/powernv: Add driver for operator panel on FSP machines

2016-06-29 17:33:46 +10:00

ppdev.c

ppdev: remove unused ROUND_UP macro

2017-07-17 17:23:17 +02:00

ps3flash.c

wrappers for ->i_mutex access

2016-01-22 18:04:28 -05:00

random.c

random: mix rdrand with entropy sent in from userspace

2018-08-03 07:50:42 +02:00

raw.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

rtc.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

scx200_gpio.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

snsc_event.c

sched/headers: Prepare for new header dependencies before moving code to <linux/sched/signal.h>

2017-03-02 08:42:29 +01:00

snsc.c

sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h>

2017-03-02 08:42:32 +01:00

snsc.h

…

sonypi.c

dmi: Mark all struct dmi_system_id instances const

2017-09-14 11:59:30 +02:00

tb0219.c

mips: separate extable.h, switch module.h to it

2016-10-05 18:36:18 -04:00

tile-srom.c

tile-srom: allow the driver to be built as a module

2016-11-10 15:18:56 +01:00

tlclk.c

char: tlclk: constify attribute_group structures.

2017-08-28 17:15:16 +02:00

toshiba.c

Replace <asm/uaccess.h> with <linux/uaccess.h> globally

2016-12-24 11:46:01 -08:00

ttyprintk.c

ttyprintk: Neaten and simplify printing

2016-09-13 17:30:17 +02:00

uv_mmtimer.c

…

virtio_console.c

virtio_console: reset on out of memory

2018-05-01 12:58:12 -07:00