archive mirror
 help / color / mirror / Atom feed
* [PATCH] misc: hmc6352: fix potential Spectre v1
@ 2018-08-15 15:50 Gustavo A. R. Silva
  0 siblings, 0 replies; only message in thread
From: Gustavo A. R. Silva @ 2018-08-15 15:50 UTC (permalink / raw)
  To: Arnd Bergmann, Greg Kroah-Hartman; +Cc: linux-kernel, Gustavo A. R. Silva

val is indirectly controlled by user-space, hence leading to a
potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/misc/hmc6352.c:54 compass_store() warn: potential spectre issue
'map' [r]

Fix this by sanitizing val before using it to index map

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].


Signed-off-by: Gustavo A. R. Silva <>
 drivers/misc/hmc6352.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c
index eeb7eef..38f90e1 100644
--- a/drivers/misc/hmc6352.c
+++ b/drivers/misc/hmc6352.c
@@ -27,6 +27,7 @@
 #include <linux/err.h>
 #include <linux/delay.h>
 #include <linux/sysfs.h>
+#include <linux/nospec.h>
 static DEFINE_MUTEX(compass_mutex);
@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count,
 		return ret;
 	if (val >= strlen(map))
 		return -EINVAL;
+	val = array_index_nospec(val, strlen(map));
 	ret = compass_command(c, map[val]);

^ permalink raw reply related	[flat|nested] only message in thread

only message in thread, other threads:[~2018-08-15 16:12 UTC | newest]

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-08-15 15:50 [PATCH] misc: hmc6352: fix potential Spectre v1 Gustavo A. R. Silva

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).