From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Sasha Levin <sashal@kernel.org>,
Jordy Zomer <jordy@jordyzomer.github.io>,
Mike Snitzer <snitzer@redhat.com>,
snitzer@kernel.org, dm-devel@redhat.com,
Jordy Zomer <jordy@pwning.systems>,
agk@redhat.com
Subject: [dm-devel] [PATCH AUTOSEL 4.9 07/16] dm ioctl: prevent potential spectre v1 gadget
Date: Fri, 1 Apr 2022 10:48:18 -0400 [thread overview]
Message-ID: <20220401144827.1955845-7-sashal@kernel.org> (raw)
In-Reply-To: <20220401144827.1955845-1-sashal@kernel.org>
[-- Attachment #1: Type: application/octet-stream, Size: 1185 bytes --]
From: Jordy Zomer <jordy@jordyzomer.github.io>
[ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ]
It appears like cmd could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents of kernel memory
from being leaked to userspace via speculative execution by using
array_index_nospec.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index eb2659a12310..70245782e7f6 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -16,6 +16,7 @@
#include <linux/dm-ioctl.h>
#include <linux/hdreg.h>
#include <linux/compat.h>
+#include <linux/nospec.h>
#include <asm/uaccess.h>
@@ -1642,6 +1643,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
return NULL;
+ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
*ioctl_flags = _ioctls[cmd].flags;
return _ioctls[cmd].fn;
}
--
2.34.1
[-- Attachment #2: Type: text/plain, Size: 98 bytes --]
--
dm-devel mailing list
dm-devel@redhat.com
https://listman.redhat.com/mailman/listinfo/dm-devel
WARNING: multiple messages have this Message-ID (diff)
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jordy Zomer <jordy@jordyzomer.github.io>,
Jordy Zomer <jordy@pwning.systems>,
Mike Snitzer <snitzer@redhat.com>,
Sasha Levin <sashal@kernel.org>,
agk@redhat.com, snitzer@kernel.org, dm-devel@redhat.com
Subject: [PATCH AUTOSEL 4.9 07/16] dm ioctl: prevent potential spectre v1 gadget
Date: Fri, 1 Apr 2022 10:48:18 -0400 [thread overview]
Message-ID: <20220401144827.1955845-7-sashal@kernel.org> (raw)
In-Reply-To: <20220401144827.1955845-1-sashal@kernel.org>
From: Jordy Zomer <jordy@jordyzomer.github.io>
[ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ]
It appears like cmd could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents of kernel memory
from being leaked to userspace via speculative execution by using
array_index_nospec.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/dm-ioctl.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index eb2659a12310..70245782e7f6 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -16,6 +16,7 @@
#include <linux/dm-ioctl.h>
#include <linux/hdreg.h>
#include <linux/compat.h>
+#include <linux/nospec.h>
#include <asm/uaccess.h>
@@ -1642,6 +1643,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
return NULL;
+ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
*ioctl_flags = _ioctls[cmd].flags;
return _ioctls[cmd].fn;
}
--
2.34.1
next prev parent reply other threads:[~2022-04-01 14:48 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-01 14:48 [PATCH AUTOSEL 4.9 01/16] ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111 Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 02/16] ptp: replace snprintf with sysfs_emit Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 03/16] powerpc: dts: t104xrdb: fix phy type for FMAN 4/5 Sasha Levin
2022-04-01 14:48 ` Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 04/16] scsi: mvsas: Replace snprintf() with sysfs_emit() Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 05/16] scsi: bfa: " Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 06/16] iommu/arm-smmu-v3: fix event handling soft lockup Sasha Levin
2022-04-01 14:48 ` Sasha Levin
2022-04-01 14:48 ` Sasha Levin [this message]
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 07/16] dm ioctl: prevent potential spectre v1 gadget Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 08/16] scsi: pm8001: Fix pm8001_mpi_task_abort_resp() Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 09/16] scsi: aha152x: Fix aha152x_setup() __setup handler return value Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 10/16] bnxt_en: Eliminate unintended link toggle during FW reset Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 11/16] MIPS: fix fortify panic when copying asm exception handlers Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 12/16] scsi: libfc: Fix use after free in fc_exch_abts_resp() Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 13/16] usb: dwc3: omap: fix "unbalanced disables for smps10_out1" on omap5evm Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 14/16] xtensa: fix DTC warning unit_address_format Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 15/16] Bluetooth: Fix use after free in hci_send_acl Sasha Levin
2022-04-01 14:48 ` [PATCH AUTOSEL 4.9 16/16] init/main.c: return 1 from handled __setup() functions Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220401144827.1955845-7-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=agk@redhat.com \
--cc=dm-devel@redhat.com \
--cc=jordy@jordyzomer.github.io \
--cc=jordy@pwning.systems \
--cc=linux-kernel@vger.kernel.org \
--cc=snitzer@kernel.org \
--cc=snitzer@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.