* [PATCH] dma-buf: heaps: Fix potential spectre v1 gadget
@ 2022-01-29 15:06 Jordy Zomer
2022-01-31 20:39 ` John Stultz
0 siblings, 1 reply; 3+ messages in thread
From: Jordy Zomer @ 2022-01-29 15:06 UTC (permalink / raw)
To: linux-kernel
Cc: Jordy Zomer, Sumit Semwal, Benjamin Gaignard, Liam Mark,
Laura Abbott, Brian Starkey, John Stultz, Christian König,
linux-media, dri-devel, linaro-mm-sig
It appears like nr could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents
of kernel memory from being leaked to userspace via speculative
execution by using array_index_nospec.
Signed-off-by: Jordy Zomer <jordy@pwning.systems>
---
drivers/dma-buf/dma-heap.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
index 56bf5ad01ad5..8f5848aa144f 100644
--- a/drivers/dma-buf/dma-heap.c
+++ b/drivers/dma-buf/dma-heap.c
@@ -14,6 +14,7 @@
#include <linux/xarray.h>
#include <linux/list.h>
#include <linux/slab.h>
+#include <linux/nospec.h>
#include <linux/uaccess.h>
#include <linux/syscalls.h>
#include <linux/dma-heap.h>
@@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
return -EINVAL;
+ nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));
/* Get the kernel ioctl cmd that matches */
kcmd = dma_heap_ioctl_cmds[nr];
--
2.27.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] dma-buf: heaps: Fix potential spectre v1 gadget
2022-01-29 15:06 [PATCH] dma-buf: heaps: Fix potential spectre v1 gadget Jordy Zomer
@ 2022-01-31 20:39 ` John Stultz
2022-02-01 8:05 ` Sumit Semwal
0 siblings, 1 reply; 3+ messages in thread
From: John Stultz @ 2022-01-31 20:39 UTC (permalink / raw)
To: Jordy Zomer
Cc: linux-kernel, Sumit Semwal, Benjamin Gaignard, Liam Mark,
Laura Abbott, Brian Starkey, Christian König, linux-media,
dri-devel, linaro-mm-sig
On Sat, Jan 29, 2022 at 7:06 AM Jordy Zomer <jordy@pwning.systems> wrote:
>
> It appears like nr could be a Spectre v1 gadget as it's supplied by a
> user and used as an array index. Prevent the contents
> of kernel memory from being leaked to userspace via speculative
> execution by using array_index_nospec.
>
> Signed-off-by: Jordy Zomer <jordy@pwning.systems>
> ---
> drivers/dma-buf/dma-heap.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
> index 56bf5ad01ad5..8f5848aa144f 100644
> --- a/drivers/dma-buf/dma-heap.c
> +++ b/drivers/dma-buf/dma-heap.c
> @@ -14,6 +14,7 @@
> #include <linux/xarray.h>
> #include <linux/list.h>
> #include <linux/slab.h>
> +#include <linux/nospec.h>
> #include <linux/uaccess.h>
> #include <linux/syscalls.h>
> #include <linux/dma-heap.h>
> @@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
> if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
> return -EINVAL;
>
> + nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));
> /* Get the kernel ioctl cmd that matches */
> kcmd = dma_heap_ioctl_cmds[nr];
Thanks for submitting this! It looks sane to me.
Acked-by: John Stultz <john.stultz@linaro.org>
thanks
-john
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] dma-buf: heaps: Fix potential spectre v1 gadget
2022-01-31 20:39 ` John Stultz
@ 2022-02-01 8:05 ` Sumit Semwal
0 siblings, 0 replies; 3+ messages in thread
From: Sumit Semwal @ 2022-02-01 8:05 UTC (permalink / raw)
To: John Stultz
Cc: Jordy Zomer, linux-kernel, Benjamin Gaignard, Liam Mark,
Laura Abbott, Brian Starkey, Christian König, linux-media,
dri-devel, linaro-mm-sig
Hello Jordy,
On Tue, 1 Feb 2022 at 02:09, John Stultz <john.stultz@linaro.org> wrote:
>
> On Sat, Jan 29, 2022 at 7:06 AM Jordy Zomer <jordy@pwning.systems> wrote:
> >
> > It appears like nr could be a Spectre v1 gadget as it's supplied by a
> > user and used as an array index. Prevent the contents
> > of kernel memory from being leaked to userspace via speculative
> > execution by using array_index_nospec.
> >
> > Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Thanks very much for your patch; I've pushed it to drm-misc-fixes, so
we should see it in mainline soon.
> > ---
> > drivers/dma-buf/dma-heap.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/dma-buf/dma-heap.c b/drivers/dma-buf/dma-heap.c
> > index 56bf5ad01ad5..8f5848aa144f 100644
> > --- a/drivers/dma-buf/dma-heap.c
> > +++ b/drivers/dma-buf/dma-heap.c
> > @@ -14,6 +14,7 @@
> > #include <linux/xarray.h>
> > #include <linux/list.h>
> > #include <linux/slab.h>
> > +#include <linux/nospec.h>
> > #include <linux/uaccess.h>
> > #include <linux/syscalls.h>
> > #include <linux/dma-heap.h>
> > @@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd,
> > if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))
> > return -EINVAL;
> >
> > + nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));
> > /* Get the kernel ioctl cmd that matches */
> > kcmd = dma_heap_ioctl_cmds[nr];
>
> Thanks for submitting this! It looks sane to me.
>
> Acked-by: John Stultz <john.stultz@linaro.org>
>
> thanks
> -john
Best,
Sumit.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-02-01 8:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-01-29 15:06 [PATCH] dma-buf: heaps: Fix potential spectre v1 gadget Jordy Zomer
2022-01-31 20:39 ` John Stultz
2022-02-01 8:05 ` Sumit Semwal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).