diff options
| author | Dan Williams <dan.j.williams@intel.com> | 2020-11-24 02:43:53 +0100 |
|---|---|---|
| committer | Dan Williams <dan.j.williams@intel.com> | 2020-11-24 02:43:53 +0100 |
| commit | 9a7e3d7f056831a6193d6d737fb7a26dfdceb04b (patch) | |
| tree | 2ac4133f657744f067dbbbdffb5419723b2e8207 /drivers/nvdimm/btt.c | |
| parent | libnvdimm/namespace: Fix reaping of invalidated block-window-namespace labels (diff) | |
| download | linux-9a7e3d7f056831a6193d6d737fb7a26dfdceb04b.tar.xz linux-9a7e3d7f056831a6193d6d737fb7a26dfdceb04b.zip | |
ACPI: NFIT: Fix input validation of bus-family
Dan reports that smatch thinks userspace can craft an out-of-bound bus
family number. However, nd_cmd_clear_to_send() blocks all non-zero
values of bus-family since only the kernel can initiate these commands.
However, in the speculation path, family is a user controlled array
index value so mask it for speculation safety. Also, since the
nd_cmd_clear_to_send() safety is non-obvious and possibly may change in
the future include input validation as if userspace could get past the
nd_cmd_clear_to_send() gatekeeper.
Link: http://lore.kernel.org/r/20201111113000.GA1237157@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
Diffstat (limited to 'drivers/nvdimm/btt.c')
0 files changed, 0 insertions, 0 deletions