lkml.org 
[lkml]   [2018]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 34/61] ALSA: hda: Hardening for potential Spectre v1
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Takashi Iwai <tiwai@suse.de>

    commit 69fa6f19b95597618ab30438a27b67ad93daa7c7 upstream.

    As recently Smatch suggested, one place in HD-audio hwdep ioctl codes
    may expand the array directly from the user-space value with
    speculation:
    sound/pci/hda/hda_local.h:467 get_wcaps() warn: potential spectre issue 'codec->wcaps'

    As get_wcaps() itself is a fairly frequently called inline function,
    and there is only one single call with a user-space value, we replace
    only the latter one to open-code locally with array_index_nospec()
    hardening in this patch.

    BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    sound/pci/hda/hda_hwdep.c | 12 +++++++++++-
    1 file changed, 11 insertions(+), 1 deletion(-)

    --- a/sound/pci/hda/hda_hwdep.c
    +++ b/sound/pci/hda/hda_hwdep.c
    @@ -21,6 +21,7 @@
    #include <linux/init.h>
    #include <linux/slab.h>
    #include <linux/compat.h>
    +#include <linux/nospec.h>
    #include <sound/core.h>
    #include "hda_codec.h"
    #include "hda_local.h"
    @@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_cod

    if (get_user(verb, &arg->verb))
    return -EFAULT;
    - res = get_wcaps(codec, verb >> 24);
    + /* open-code get_wcaps(verb>>24) with nospec */
    + verb >>= 24;
    + if (verb < codec->core.start_nid ||
    + verb >= codec->core.start_nid + codec->core.num_nodes) {
    + res = 0;
    + } else {
    + verb -= codec->core.start_nid;
    + verb = array_index_nospec(verb, codec->core.num_nodes);
    + res = codec->wcaps[verb];
    + }
    if (put_user(res, &arg->res))
    return -EFAULT;
    return 0;

    \
     
     \ /
      Last update: 2018-04-30 22:24    [W:3.195 / U:0.088 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site