From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3E9EF1799F; Wed, 3 Jul 2024 11:02:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720004555; cv=none; b=QO00BKih/jPqkIsInk5Cm0R0VPm9aw64LxYNKOuQ4y38SFcoRsoNO52km/6cPtrdORqU0wYsPEH14vsVa/ifvIcWUhwfSR9f0Jkpf/2LCjJ5ny/juquhNoqxr++R7yRtXU9VtoM1ByT0azv6zNcnHOr52I37Qd2R0InqLXl2+lU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720004555; c=relaxed/simple; bh=y/xnLKxuu5fHBkadusWKJANyhcrvEt0ursHiJyWb2zg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=TO6++Za4kwf6gC/C6CV6B3tEX+dFP+1psCbk6XHN0/yMmFUaUwQ9mqKG+qZHHhs/94fx25ZvAt0LcHUaa6TelQMTjsbj/iVg35/6sDb4L2vasZYUYXzd8Bk05pSPBCajJwcCGaSPeVR+rVD/rY496vQO+OJIDMFFUOd6GrrxAh8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=loQYpXyl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="loQYpXyl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9828C2BD10; Wed, 3 Jul 2024 11:02:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1720004555; bh=y/xnLKxuu5fHBkadusWKJANyhcrvEt0ursHiJyWb2zg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=loQYpXylzIqFrdhqu6I1Zrr0BUIagnLVSzcvE/KJhANTr16JLW4Zkv8avpJav56aX 25CXQzwFD6hqf2tNFTO9ulMCaSDxBNimSrck5KQ5+O3ULkCbRvSGGc/3OM0hKjVtf9 DE4P0kN8wYS8DJ1K/Za2BTScgZ/BVE18eHFxvz7c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Hagar Gamal Halim Hemdan Subject: [PATCH 5.10 080/290] vmci: prevent speculation leaks by sanitizing event in event_deliver() Date: Wed, 3 Jul 2024 12:37:41 +0200 Message-ID: <20240703102907.218527052@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240703102904.170852981@linuxfoundation.org> References: <20240703102904.170852981@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hagar Gamal Halim Hemdan commit 8003f00d895310d409b2bf9ef907c56b42a4e0f4 upstream. Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization. This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Only compile tested, no access to HW. Fixes: 1d990201f9bb ("VMCI: event handling implementation.") Cc: stable Signed-off-by: Hagar Gamal Halim Hemdan Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/misc/vmw_vmci/vmci_event.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/misc/vmw_vmci/vmci_event.c +++ b/drivers/misc/vmw_vmci/vmci_event.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -86,9 +87,12 @@ static void event_deliver(struct vmci_ev { struct vmci_subscription *cur; struct list_head *subscriber_list; + u32 sanitized_event, max_vmci_event; rcu_read_lock(); - subscriber_list = &subscriber_array[event_msg->event_data.event]; + max_vmci_event = ARRAY_SIZE(subscriber_array); + sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event); + subscriber_list = &subscriber_array[sanitized_event]; list_for_each_entry_rcu(cur, subscriber_list, node) { cur->callback(cur->id, &event_msg->event_data, cur->callback_data);