Messages in this thread Patch in this message | | | Date | Fri, 20 Apr 2018 15:14:08 +0200 | From | Peter Zijlstra <> | Subject | [PATCH 1/7] perf: Fix possible Spectre-v1 for aux_pages |
| |
> kernel/events/ring_buffer.c:871 perf_mmap_to_page() warn: potential spectre issue 'rb->aux_pages'
Userspace controls @pgoff through the fault address. Sanitize the array index before doing the array dereference.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> --- kernel/events/ring_buffer.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
--- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -867,8 +867,10 @@ perf_mmap_to_page(struct ring_buffer *rb return NULL; /* AUX space */ - if (pgoff >= rb->aux_pgoff) - return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]); + if (pgoff >= rb->aux_pgoff) { + int aux_pgoff = array_index_nospec(pgoff - rb->aux_pgoff, rb->aux_nr_pages); + return virt_to_page(rb->aux_pages[aux_pgoff]); + } } return __perf_mmap_to_page(rb, pgoff);
| |