From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 708E1145FEF; Wed, 19 Jun 2024 13:22:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718803341; cv=none; b=T53SIBnl7IUgQ0zLLTs5Vlhn37NlkOgNjQ6DowZHSd9oGSwjXAbqf4nsItixnJSgZmcNzQxRbAno/txA+gPf98xagGD7zKA5VrMmKVCdA61KMnp5yrlPRli3zxt5Fn+g90Wj+NUdnzsuY5Ppip8CzU4aGvjsxoqmGzoB5Di+Y6Y= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1718803341; c=relaxed/simple; bh=ALDcpCO6qEE6oVjEFa2Q3IFMIJna1tz2YZ6tINBweqQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=r4dXVdCv/43UjuqF9y4kbnU3QkzgY4G5Ta7q6dzRr8LUon7T4glRnpNGpqSp07v9PKr+NkzGrL/YkHIT9AMLw7UbeSehM7mslWnH5H9tePI1u/eKvyTVk6frJTw6+VzfjQNAR9JWeP/KDU0RkFCdY7bJYV5t6hSnQZ56Iv5xAO4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TLOx9sjx; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TLOx9sjx" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8875C2BBFC; Wed, 19 Jun 2024 13:22:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1718803341; bh=ALDcpCO6qEE6oVjEFa2Q3IFMIJna1tz2YZ6tINBweqQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TLOx9sjxDhIRB6vSlGwkZ8lgKCbRn+p15xE0NZuRGT2c83snviKOGwfSJd2faagLR U5RapnC1Pxl9TAuSbGiGHoaPWEAUY3PMe9m9e7+APRr4wjS1TtZ3HbxJgRU8JtD616 rzBwXNNCRtUMrN4hwrQ2yEQimIByGPtF5cd14O44= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Hagar Gamal Halim Hemdan Subject: [PATCH 6.9 234/281] vmci: prevent speculation leaks by sanitizing event in event_deliver() Date: Wed, 19 Jun 2024 14:56:33 +0200 Message-ID: <20240619125618.965819385@linuxfoundation.org> X-Mailer: git-send-email 2.45.2 In-Reply-To: <20240619125609.836313103@linuxfoundation.org> References: <20240619125609.836313103@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hagar Gamal Halim Hemdan commit 8003f00d895310d409b2bf9ef907c56b42a4e0f4 upstream. Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization. This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Only compile tested, no access to HW. Fixes: 1d990201f9bb ("VMCI: event handling implementation.") Cc: stable Signed-off-by: Hagar Gamal Halim Hemdan Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/misc/vmw_vmci/vmci_event.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/misc/vmw_vmci/vmci_event.c +++ b/drivers/misc/vmw_vmci/vmci_event.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -86,9 +87,12 @@ static void event_deliver(struct vmci_ev { struct vmci_subscription *cur; struct list_head *subscriber_list; + u32 sanitized_event, max_vmci_event; rcu_read_lock(); - subscriber_list = &subscriber_array[event_msg->event_data.event]; + max_vmci_event = ARRAY_SIZE(subscriber_array); + sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event); + subscriber_list = &subscriber_array[sanitized_event]; list_for_each_entry_rcu(cur, subscriber_list, node) { cur->callback(cur->id, &event_msg->event_data, cur->callback_data);