lkml.org 
[lkml]   [2022]   [Apr]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 097/343] dm ioctl: prevent potential spectre v1 gadget
    Date
    From: Jordy Zomer <jordy@jordyzomer.github.io>

    [ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ]

    It appears like cmd could be a Spectre v1 gadget as it's supplied by a
    user and used as an array index. Prevent the contents of kernel memory
    from being leaked to userspace via speculative execution by using
    array_index_nospec.

    Signed-off-by: Jordy Zomer <jordy@pwning.systems>
    Signed-off-by: Mike Snitzer <snitzer@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/md/dm-ioctl.c | 2 ++
    1 file changed, 2 insertions(+)

    diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
    index 21fe8652b095..901abd6dea41 100644
    --- a/drivers/md/dm-ioctl.c
    +++ b/drivers/md/dm-ioctl.c
    @@ -18,6 +18,7 @@
    #include <linux/dm-ioctl.h>
    #include <linux/hdreg.h>
    #include <linux/compat.h>
    +#include <linux/nospec.h>

    #include <linux/uaccess.h>
    #include <linux/ima.h>
    @@ -1788,6 +1789,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags)
    if (unlikely(cmd >= ARRAY_SIZE(_ioctls)))
    return NULL;

    + cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls));
    *ioctl_flags = _ioctls[cmd].flags;
    return _ioctls[cmd].fn;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-04-12 11:32    [W:6.071 / U:0.436 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site