From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Jordy Zomer <jordy@jordyzomer.github.io>,
Mike Snitzer <snitzer@redhat.com>,
snitzer@kernel.org, dm-devel@redhat.com,
Jordy Zomer <jordy@pwning.systems>,
agk@redhat.com
Subject: [dm-devel] [PATCH AUTOSEL 5.4 19/37] dm ioctl: prevent potential spectre v1 gadget
Date: Fri, 1 Apr 2022 10:44:28 -0400 [thread overview]
Message-ID: <20220401144446.1954694-19-sashal@kernel.org> (raw)
In-Reply-To: <20220401144446.1954694-1-sashal@kernel.org>
[-- Attachment #1: Type: application/octet-stream, Size: 1187 bytes --]
From: Jordy Zomer <jordy@jordyzomer.github.io>
[ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ]
It appears like cmd could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents of kernel memory
from being leaked to userspace via speculative execution by using
array_index_nospec.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 3f15d8dc2b71..7a73f2fa0ad7 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -17,6 +17,7 @@
#include <linux/dm-ioctl.h>
#include <linux/hdreg.h>
#include <linux/compat.h>
+#include <linux/nospec.h>
#include <linux/uaccess.h>
@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
return NULL;
+ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
*ioctl_flags = _ioctls[cmd].flags;
return _ioctls[cmd].fn;
}
--
2.34.1
[-- Attachment #2: Type: text/plain, Size: 98 bytes --]
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jordy Zomer <jordy@jordyzomer.github.io>,
Jordy Zomer <jordy@pwning.systems>,
Mike Snitzer <snitzer@redhat.com>,
Sasha Levin <sashal@kernel.org>,
agk@redhat.com, snitzer@kernel.org, dm-devel@redhat.com
Subject: [PATCH AUTOSEL 5.4 19/37] dm ioctl: prevent potential spectre v1 gadget
Date: Fri, 1 Apr 2022 10:44:28 -0400 [thread overview]
Message-ID: <20220401144446.1954694-19-sashal@kernel.org> (raw)
In-Reply-To: <20220401144446.1954694-1-sashal@kernel.org>
From: Jordy Zomer <jordy@jordyzomer.github.io>
[ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ]
It appears like cmd could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents of kernel memory
from being leaked to userspace via speculative execution by using
array_index_nospec.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 3f15d8dc2b71..7a73f2fa0ad7 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -17,6 +17,7 @@
#include <linux/dm-ioctl.h>
#include <linux/hdreg.h>
#include <linux/compat.h>
+#include <linux/nospec.h>
#include <linux/uaccess.h>
@@ -1696,6 +1697,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
return NULL;
+ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
*ioctl_flags = _ioctls[cmd].flags;
return _ioctls[cmd].fn;
}
--
2.34.1
next prev parent reply other threads:[~2022-04-01 14:45 UTC|newest]
Thread overview: 54+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-01 14:44 [PATCH AUTOSEL 5.4 01/37] drm: Add orientation quirk for GPD Win Max Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 02/37] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 03/37] drm/amd/amdgpu/amdgpu_cs: fix refcount leak of a dma_fence obj Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 04/37] ptp: replace snprintf with sysfs_emit Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 05/37] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 06/37] bpf: Make dst_port field in struct bpf_sock 16-bit wide Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 07/37] scsi: mvsas: Replace snprintf() with sysfs_emit() Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 08/37] scsi: bfa: " Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 09/37] power: supply: axp20x_battery: properly report current when discharging Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 10/37] ipv6: make mc_forwarding atomic Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 11/37] powerpc: Set crashkernel offset to mid of RMA region Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 12/37] drm/amdgpu: Fix recursive locking warning Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 13/37] PCI: aardvark: Fix support for MSI interrupts Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 14/37] iommu/arm-smmu-v3: fix event handling soft lockup Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 15/37] usb: ehci: add pci device support for Aspeed platforms Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 16/37] PCI: pciehp: Add Qualcomm quirk for Command Completed erratum Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 17/37] power: supply: axp288-charger: Set Vhold to 4.4V Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 18/37] ipv4: Invalidate neighbour for broadcast address upon address addition Sasha Levin
2022-04-01 14:44 ` Sasha Levin [this message]
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 19/37] dm ioctl: prevent potential spectre v1 gadget Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 20/37] drm/amdkfd: make CRAT table missing message informational only Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 21/37] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 22/37] scsi: aha152x: Fix aha152x_setup() __setup handler return value Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 23/37] net/smc: correct settings of RMB window update limit Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 24/37] mips: ralink: fix a refcount leak in ill_acc_of_setup() Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 25/37] macvtap: advertise link netns via netlink Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 26/37] tuntap: add sanity checks about msg_controllen in sendmsg Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 27/37] iommu/iova: Improve 32-bit free space estimate Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 28/37] bnxt_en: Eliminate unintended link toggle during FW reset Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 29/37] MIPS: fix fortify panic when copying asm exception handlers Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 30/37] powerpc/code-patching: Pre-map patch area Sasha Levin
2022-04-01 14:44 ` Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 31/37] scsi: libfc: Fix use after free in fc_exch_abts_resp() Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 32/37] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 33/37] xtensa: fix DTC warning unit_address_format Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 34/37] Bluetooth: Fix use after free in hci_send_acl Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 35/37] netlabel: fix out-of-bounds memory accesses Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 36/37] init/main.c: return 1 from handled __setup() functions Sasha Levin
2022-04-01 14:44 ` [PATCH AUTOSEL 5.4 37/37] minix: fix bug when opening a file with O_DIRECT Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401144446.1954694-19-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=agk@redhat.com \
--cc=dm-devel@redhat.com \
--cc=jordy@jordyzomer.github.io \
--cc=jordy@pwning.systems \
--cc=linux-kernel@vger.kernel.org \
--cc=snitzer@kernel.org \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.