From: Deepak Singh Rawat <drawat@vmware.com>
To: "Gustavo A. R. Silva" <gustavo@embeddedor.com>,
linux-graphics-maintainer <linux-graphics-maintainer@vmware.com>,
Sinclair Yeh <syeh@vmware.com>,
Thomas Hellstrom <thellstrom@vmware.com>,
David Airlie <airlied@linux.ie>
Cc: "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
"dri-devel@lists.freedesktop.org"
<dri-devel@lists.freedesktop.org>
Subject: RE: [Linux-graphics-maintainer] [PATCH] drm/vmwgfx: Fix potential Spectre v1
Date: Mon, 20 Aug 2018 20:53:17 +0000 [thread overview]
Message-ID: <BYAPR05MB41817986B00F59780A68D63CBA320@BYAPR05MB4181.namprd05.prod.outlook.com> (raw)
In-Reply-To: <20180816193015.GA12093@embeddedor.com>
Looks good to me based on my limited understanding. Thomas/Sinclair can
could you please review and then we can include this in drm-fixes.
Thanks,
Deepak
>
> arg.version is indirectly controlled by user-space, hence leading to
> a potential exploitation of the Spectre variant 1 vulnerability.
>
> This issue was detected with the help of Smatch:
>
> drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c:4526 vmw_execbuf_ioctl()
> warn:
> potential spectre issue 'copy_offset' [w]
>
> Fix this by sanitizing arg.version before using it to index copy_offset
>
> Notice that given that speculation windows are large, the policy is
> to kill the speculation on the first load and not worry if it can be
> completed with a dependent load/store [1].
>
> [1]
> https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmarc.i
> nfo%2F%3Fl%3Dlinux-
> kernel%26m%3D152449131114778%26w%3D2&data=02%7C01%7Clinux-
> graphics-
> maintainer%40vmware.com%7Cf010b707b8ef4896c1a908d603aebcc6%7Cb39
> 138ca3cee4b4aa4d6cd83d9dd62f0%7C1%7C0%7C636700446365603728&
> sdata=0D8lnUScxOmCCWXLHh8Otc3o%2F1yF1SxgGwIklRdMlXY%3D&re
> served=0
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
> ---
> drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 7 +++++--
> 1 file changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> index 1f13457..ad91c6e 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
> @@ -25,6 +25,7 @@
> *
>
> **********************************************************
> ****************/
> #include <linux/sync_file.h>
> +#include <linux/nospec.h>
>
> #include "vmwgfx_drv.h"
> #include "vmwgfx_reg.h"
> @@ -4520,8 +4521,10 @@ int vmw_execbuf_ioctl(struct drm_device *dev,
> unsigned long data,
> return -EINVAL;
> }
>
> - if (arg.version > 1 &&
> - copy_from_user(&arg.context_handle,
> + if (arg.version >= ARRAY_SIZE(copy_offset))
> + return -EFAULT;
> + arg.version = array_index_nospec(arg.version,
> ARRAY_SIZE(copy_offset));
> + if (copy_from_user(&arg.context_handle,
> (void __user *) (data + copy_offset[0]),
> copy_offset[arg.version - 1] -
> copy_offset[0]) != 0)
> --
> 2.7.4
>
> _______________________________________________
> Sent to linux-graphics-maintainer@vmware.com
next prev parent reply other threads:[~2018-08-20 20:53 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-08-16 19:30 [PATCH] drm/vmwgfx: Fix potential Spectre v1 Gustavo A. R. Silva
2018-08-20 20:53 ` Deepak Singh Rawat [this message]
2018-08-21 8:19 ` [Linux-graphics-maintainer] " Thomas Hellstrom
2018-08-23 14:43 ` Gustavo A. R. Silva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=BYAPR05MB41817986B00F59780A68D63CBA320@BYAPR05MB4181.namprd05.prod.outlook.com \
--to=drawat@vmware.com \
--cc=airlied@linux.ie \
--cc=dri-devel@lists.freedesktop.org \
--cc=gustavo@embeddedor.com \
--cc=linux-graphics-maintainer@vmware.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syeh@vmware.com \
--cc=thellstrom@vmware.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).