Messages in this thread Patch in this message | | | Date | Fri, 20 Apr 2018 15:14:13 +0200 | From | Peter Zijlstra <> | Subject | [PATCH 6/7] sched: Fix possible Spectre-v1 for sched_prio_to_weight[] |
| |
> kernel/sched/core.c:6921 cpu_weight_nice_write_s64() warn: potential spectre issue 'sched_prio_to_weight'
Userspace controls @nice, so sanitize the value before using it to index an array.
Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> --- kernel/sched/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
--- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6928,11 +6928,14 @@ static int cpu_weight_nice_write_s64(str struct cftype *cft, s64 nice) { unsigned long weight; + int idx; if (nice < MIN_NICE || nice > MAX_NICE) return -ERANGE; - weight = sched_prio_to_weight[NICE_TO_PRIO(nice) - MAX_RT_PRIO]; + idx = array_index_nospec(NICE_TO_PRIO(nice) - MAX_RT_PRIO, 40); + weight = sched_prio_to_weight[idx]; + return sched_group_set_shares(css_tg(css), scale_load(weight)); } #endif
| |