All of lore.kernel.org
 help / color / mirror / Atom feed
* usb: gadget: storage: Fix Spectre v1 vulnerability
  2018-10-16 10:16 ` [PATCH] " Gustavo A. R. Silva
@ 2018-10-16 11:28 ` Felipe Balbi
  -1 siblings, 0 replies; 6+ messages in thread
From: Felipe Balbi @ 2018-10-16 11:28 UTC (permalink / raw)
  To: Gustavo A. R. Silva, Greg Kroah-Hartman; +Cc: linux-usb, linux-kernel

Hi Greg,

"Gustavo A. R. Silva" <gustavo@embeddedor.com> writes:

> num can be indirectly controlled by user-space, hence leading to
> a potential exploitation of the Spectre variant 1 vulnerability.
>
> This issue was detected with the help of Smatch:
>
> drivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn:
> potential spectre issue 'fsg_opts->common->luns' [r] (local cap)
>
> Fix this by sanitizing num before using it to index
> fsg_opts->common->luns
>
> Notice that given that speculation windows are large, the policy is
> to kill the speculation on the first load and not worry if it can be
> completed with a dependent load/store [1].
>
> [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>

Can you still take this as an urgent fix?

Acked-by: Felipe Balbi <felipe.balbi@intel.com>

^ permalink raw reply	[flat|nested] 6+ messages in thread
* usb: gadget: storage: Fix Spectre v1 vulnerability
  2018-10-16 11:28 ` [PATCH] " Felipe Balbi
@ 2018-10-16 11:34 ` Greg Kroah-Hartman
  -1 siblings, 0 replies; 6+ messages in thread
From: Greg Kroah-Hartman @ 2018-10-16 11:34 UTC (permalink / raw)
  To: Felipe Balbi; +Cc: Gustavo A. R. Silva, linux-usb, linux-kernel

On Tue, Oct 16, 2018 at 02:28:19PM +0300, Felipe Balbi wrote:
> 
> Hi Greg,
> 
> "Gustavo A. R. Silva" <gustavo@embeddedor.com> writes:
> 
> > num can be indirectly controlled by user-space, hence leading to
> > a potential exploitation of the Spectre variant 1 vulnerability.
> >
> > This issue was detected with the help of Smatch:
> >
> > drivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn:
> > potential spectre issue 'fsg_opts->common->luns' [r] (local cap)
> >
> > Fix this by sanitizing num before using it to index
> > fsg_opts->common->luns
> >
> > Notice that given that speculation windows are large, the policy is
> > to kill the speculation on the first load and not worry if it can be
> > completed with a dependent load/store [1].
> >
> > [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
> >
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> 
> Can you still take this as an urgent fix?
> 
> Acked-by: Felipe Balbi <felipe.balbi@intel.com>

Yes, will do so, thanks.

greg k-h

> 
> -- 
> balbi

^ permalink raw reply	[flat|nested] 6+ messages in thread
* usb: gadget: storage: Fix Spectre v1 vulnerability
@ 2018-10-16 10:16 ` Gustavo A. R. Silva
  0 siblings, 0 replies; 6+ messages in thread
From: Gustavo A. R. Silva @ 2018-10-16 10:16 UTC (permalink / raw)
  To: Felipe Balbi, Greg Kroah-Hartman
  Cc: linux-usb, linux-kernel, Gustavo A. R. Silva

num can be indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn:
potential spectre issue 'fsg_opts->common->luns' [r] (local cap)

Fix this by sanitizing num before using it to index
fsg_opts->common->luns

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
 drivers/usb/gadget/function/f_mass_storage.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index cb402e7a..043f97a 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -221,6 +221,8 @@
 #include <linux/usb/gadget.h>
 #include <linux/usb/composite.h>
 
+#include <linux/nospec.h>
+
 #include "configfs.h"
 
 
@@ -3152,6 +3154,7 @@ static struct config_group *fsg_lun_make(struct config_group *group,
 	fsg_opts = to_fsg_opts(&group->cg_item);
 	if (num >= FSG_MAX_LUNS)
 		return ERR_PTR(-ERANGE);
+	num = array_index_nospec(num, FSG_MAX_LUNS);
 
 	mutex_lock(&fsg_opts->lock);
 	if (fsg_opts->refcnt || fsg_opts->common->luns[num]) {

^ permalink raw reply related	[flat|nested] 6+ messages in thread
end of thread, other threads:[~2018-10-16 11:34 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-10-16 11:28 usb: gadget: storage: Fix Spectre v1 vulnerability Felipe Balbi
2018-10-16 11:28 ` [PATCH] " Felipe Balbi
  -- strict thread matches above, loose matches on Subject: below --
2018-10-16 11:34 Greg Kroah-Hartman
2018-10-16 11:34 ` [PATCH] " Greg Kroah-Hartman
2018-10-16 10:16 Gustavo A. R. Silva
2018-10-16 10:16 ` [PATCH] " Gustavo A. R. Silva

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.