From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH] ptp: fix Spectre v1 vulnerability Date: Wed, 17 Oct 2018 22:02:09 -0700 (PDT) Message-ID: <20181017.220209.613250133167153238.davem@davemloft.net> References: <20181016130641.GA603@embeddedor.com> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: richardcochran@gmail.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org To: gustavo@embeddedor.com Return-path: In-Reply-To: <20181016130641.GA603@embeddedor.com> Sender: linux-kernel-owner@vger.kernel.org List-Id: netdev.vger.kernel.org From: "Gustavo A. R. Silva" Date: Tue, 16 Oct 2018 15:06:41 +0200 > pin_index can be indirectly controlled by user-space, hence leading > to a potential exploitation of the Spectre variant 1 vulnerability. > > This issue was detected with the help of Smatch: > > drivers/ptp/ptp_chardev.c:253 ptp_ioctl() warn: potential spectre issue > 'ops->pin_config' [r] (local cap) > > Fix this by sanitizing pin_index before using it to index > ops->pin_config, and before passing it as an argument to > function ptp_set_pinfunc(), in which it is used to index > info->pin_config. > > Notice that given that speculation windows are large, the policy is > to kill the speculation on the first load and not worry if it can be > completed with a dependent load/store [1]. > > [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 > > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva Applied.