summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJordy Zomer <jordy@pwning.systems>2022-01-29 16:06:04 +0100
committerSumit Semwal <sumit.semwal@linaro.org>2022-02-01 08:48:09 +0100
commit92c4cfaee6872038563c5b6f2e8e613f9d84d47d (patch)
tree6ce6eacdcc10c27bf52fe84152d9f8712fded63a
parentdrm/nouveau: fix off by one in BIOS boundary checking (diff)
downloadlinux-92c4cfaee6872038563c5b6f2e8e613f9d84d47d.tar.xz
linux-92c4cfaee6872038563c5b6f2e8e613f9d84d47d.zip
dma-buf: heaps: Fix potential spectre v1 gadget
It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec. Signed-off-by: Jordy Zomer <jordy@pwning.systems> Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework") Cc: <stable@vger.kernel.org> # v5.6+ Acked-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org> [sumits: added fixes and cc: stable tags] Link: https://patchwork.freedesktop.org/patch/msgid/20220129150604.3461652-1-jordy@pwning.systems
-rw-r--r--drivers/dma-buf/dma-heap.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
index 56bf5ad01ad5..8f5848aa144f 100644
--- a/drivers/dma-buf/dma-heap.c
+++ b/drivers/dma-buf/dma-heap.c
@@ -14,6 +14,7 @@
#include <linux/xarray.h>
#include <linux/list.h>
#include <linux/slab.h>
+#include <linux/nospec.h>
#include <linux/uaccess.h>
#include <linux/syscalls.h>
#include <linux/dma-heap.h>
@@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
return -EINVAL;
+ nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));
/* Get the kernel ioctl cmd that matches */
kcmd = dma_heap_ioctl_cmds[nr];