All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH v2] usbip: vhci_sysfs: fix potential Spectre v1
@ 2018-05-17 20:16 ` Gustavo A. R. Silva
  0 siblings, 0 replies; 12+ messages in thread
From: Gustavo A. R. Silva @ 2018-05-17 20:16 UTC (permalink / raw)
  To: Valentina Manea, Shuah Khan, Greg Kroah-Hartman
  Cc: linux-usb, linux-kernel, Gustavo A. R. Silva

pdev_nr and rhport can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:
drivers/usb/usbip/vhci_sysfs.c:238 detach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:328 attach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:338 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_ss->vdev'
drivers/usb/usbip/vhci_sysfs.c:340 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_hs->vdev'

Fix this by sanitizing pdev_nr and rhport before using them to index
vhcis and vhci->vhci_hcd_ss->vdev respectively.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
---
Changes in v2:
 - Place the barriers into valid_port.

 drivers/usb/usbip/vhci_sysfs.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index 4880838..69db0c9 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -10,6 +10,8 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
 
+#include <linux/nospec.h>
+
 #include "usbip_common.h"
 #include "vhci.h"
 
@@ -211,10 +213,14 @@ static int valid_port(__u32 pdev_nr, __u32 rhport)
 		pr_err("pdev %u\n", pdev_nr);
 		return 0;
 	}
+	pdev_nr = array_index_nospec(pdev_nr, vhci_num_controllers);
+
 	if (rhport >= VHCI_HC_PORTS) {
 		pr_err("rhport %u\n", rhport);
 		return 0;
 	}
+	rhport = array_index_nospec(rhport, VHCI_HC_PORTS);
+
 	return 1;
 }
 
-- 
2.7.4

^ permalink raw reply related	[flat|nested] 12+ messages in thread

end of thread, other threads:[~2018-05-19 16:53 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-17 20:16 [PATCH v2] usbip: vhci_sysfs: fix potential Spectre v1 Gustavo A. R. Silva
2018-05-17 20:16 ` [v2] " Gustavo A. R. Silva
2018-05-18 13:47 ` [PATCH v2] " Greg Kroah-Hartman
2018-05-18 13:47   ` [v2] " Greg Kroah-Hartman
2018-05-18 16:06   ` [PATCH v2] " Shuah Khan
2018-05-18 16:06     ` [v2] " Shuah Khan
2018-05-18 22:27     ` [PATCH v2] " Gustavo A. R. Silva
2018-05-18 22:27       ` [v2] " Gustavo A. R. Silva
2018-05-19  7:04       ` [PATCH v2] " Greg Kroah-Hartman
2018-05-19  7:04         ` [v2] " Greg Kroah-Hartman
2018-05-19 16:53         ` [PATCH v2] " Gustavo A. R. Silva
2018-05-19 16:53           ` [v2] " Gustavo A. R. Silva

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.