From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9300D3F7874 for ; Tue, 24 Mar 2026 16:43:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774370598; cv=none; b=jboM0L3NLPJekpHs+i/CoI//y49FqL4U6wNNcTwrsBJoAvpqEVvyipDEf+Hl0igPYsOWMapaa+kUiOcsvRtbVtWFAOgE5i2haXEqupuXJ27f1RIprYi5q3nUSB9okbVZaXh/N8QqfU4UFWjhpO+FIjdmEshLkyXGy6X93jHnThY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774370598; c=relaxed/simple; bh=kUXqa/TRQ7oFjO/betJDNSrIAENFi6nmenTvhbB+3Ms=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bPB3CsuIcDWSHk/yL+06+atfhz4X2vL0t0I7SM8fLnSUq8k3r3GtNTyzjicy/qR8VM8KlvQVh5/6gukXG9cLk7ysgnEe2KJOBZOpG+DWZHNKsBb8bSLyX+NUVnykLN4unz0xlh74rXSFrHk+jErwG6uOD+5k/munfsqAx+rlIQk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ycurmRR1; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ycurmRR1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CC391C19424; Tue, 24 Mar 2026 16:43:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774370598; bh=kUXqa/TRQ7oFjO/betJDNSrIAENFi6nmenTvhbB+3Ms=; h=From:To:Cc:Subject:Date:From; b=ycurmRR1CaeN+NJ2CdK3x8RoZk0Eu0FhSpKqsR9TM4mKzl75FeIvdGRrKOXnYRD40 FfKUB7iqDid8pBBJMwUZ3npLIKhOLZG+B0YE9JvqJbVwSvdQVzzPhxe6NkJc5h2JKF uAZTlFBWh6smLWnqk42Ldj8R6lD8LjN78LxcyB4I= From: Greg Kroah-Hartman To: dri-devel@lists.freedesktop.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , stable Subject: [PATCH] drm/ioc32: stop speculation on the drm_compat_ioctl path Date: Tue, 24 Mar 2026 17:42:51 +0100 Message-ID: <2026032451-playing-rummage-8fa2@gregkh> X-Mailer: git-send-email 2.53.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1628; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=kUXqa/TRQ7oFjO/betJDNSrIAENFi6nmenTvhbB+3Ms=; b=owGbwMvMwCRo6H6F97bub03G02pJDJmH9nM/UVz+tMB2mry7aDjPmcYd/1o1OC/e3v4gmEtj2 6ldSV1NHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARQzeGeQa6R91+mky64CKW vSV++fHrjR+r9RkWLLhx1vel1TMGn5qnURqyK68wXGR3BQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list. Cc: Maarten Lankhorst Cc: Maxime Ripard Cc: Thomas Zimmermann Cc: David Airlie Cc: Simona Vetter Cc: stable Assisted-by: gkh_clanker_2000 Signed-off-by: Greg Kroah-Hartman --- My scripts caught this codepath as not being "protected" for the old-school spectre attack. I don't know how realistic it is, but it seems like this is the correct thing to be doing for a 32bit ioctl on the drm path, as "local" users can make these. drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/drm_ioc32.c b/drivers/gpu/drm/drm_ioc32.c index e6b5b06de148..f3e40d1e6098 100644 --- a/drivers/gpu/drm/drm_ioc32.c +++ b/drivers/gpu/drm/drm_ioc32.c @@ -28,6 +28,7 @@ * IN THE SOFTWARE. */ #include +#include #include #include @@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) if (nr >= ARRAY_SIZE(drm_compat_ioctls)) return drm_ioctl(filp, cmd, arg); + nr = array_index_nospec(nr, ARRAY_SIZE(drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn; if (!fn) return drm_ioctl(filp, cmd, arg); -- 2.53.0