From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Dianzhang Chen <dianzhangchen0@gmail.com>,
Thomas Gleixner <tglx@linutronix.de>,
bp@alien8.de, hpa@zytor.com
Subject: [PATCH 4.4 13/40] x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
Date: Thu, 18 Jul 2019 12:02:09 +0900 [thread overview]
Message-ID: <20190718030043.255008862@linuxfoundation.org> (raw)
In-Reply-To: <20190718030039.676518610@linuxfoundation.org>
From: Dianzhang Chen <dianzhangchen0@gmail.com>
commit 31a2fbb390fee4231281b939e1979e810f945415 upstream.
The index to access the threads ptrace_bps is controlled by userspace via
syscall: sys_ptrace(), hence leading to a potential exploitation of the
Spectre variant 1 vulnerability.
The index can be controlled from:
ptrace -> arch_ptrace -> ptrace_get_debugreg.
Fix this by sanitizing the user supplied index before using it access
thread->ptrace_bps.
Signed-off-by: Dianzhang Chen <dianzhangchen0@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: bp@alien8.de
Cc: hpa@zytor.com
Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/1561476617-3759-1-git-send-email-dianzhangchen0@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/ptrace.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -23,6 +23,7 @@
#include <linux/rcupdate.h>
#include <linux/export.h>
#include <linux/context_tracking.h>
+#include <linux/nospec.h>
#include <asm/uaccess.h>
#include <asm/pgtable.h>
@@ -697,9 +698,11 @@ static unsigned long ptrace_get_debugreg
{
struct thread_struct *thread = &tsk->thread;
unsigned long val = 0;
+ int index = n;
if (n < HBP_NUM) {
- struct perf_event *bp = thread->ptrace_bps[n];
+ struct perf_event *bp = thread->ptrace_bps[index];
+ index = array_index_nospec(index, HBP_NUM);
if (bp)
val = bp->hw.info.address;
next prev parent reply other threads:[~2019-07-18 3:15 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-18 3:01 [PATCH 4.4 00/40] 4.4.186-stable review Greg Kroah-Hartman
2019-07-18 3:01 ` [PATCH 4.4 01/40] Input: elantech - enable middle button support on 2 ThinkPads Greg Kroah-Hartman
2019-07-18 3:01 ` [PATCH 4.4 02/40] samples, bpf: fix to change the buffer size for read() Greg Kroah-Hartman
2019-07-18 3:01 ` [PATCH 4.4 03/40] mac80211: mesh: fix RCU warning Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 04/40] mwifiex: Fix possible buffer overflows at parsing bss descriptor Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 05/40] dt-bindings: can: mcp251x: add mcp25625 support Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 06/40] can: mcp251x: add support for mcp25625 Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 07/40] Input: imx_keypad - make sure keyboard can always wake up system Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 08/40] ARM: davinci: da850-evm: call regulator_has_full_constraints() Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 09/40] ARM: davinci: da8xx: specify dma_coherent_mask for lcdc Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 10/40] md: fix for divide error in status_resync Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 11/40] bnx2x: Check if transceiver implements DDM before access Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 12/40] udf: Fix incorrect final NOT_ALLOCATED (hole) extent length Greg Kroah-Hartman
2019-07-18 3:02 ` Greg Kroah-Hartman [this message]
2019-07-18 3:02 ` [PATCH 4.4 14/40] x86/tls: Fix possible spectre-v1 in do_get_thread_area() Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 15/40] mwifiex: Abort at too short BSS descriptor element Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 16/40] mwifiex: Fix heap overflow in mwifiex_uap_parse_tail_ies() Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 17/40] fscrypt: dont set policy for a dead directory Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 18/40] mwifiex: Dont abort on small, spec-compliant vendor IEs Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 19/40] USB: serial: ftdi_sio: add ID for isodebug v1 Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 20/40] USB: serial: option: add support for GosunCn ME3630 RNDIS mode Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 21/40] usb: gadget: ether: Fix race between gether_disconnect and rx_submit Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 22/40] usb: renesas_usbhs: add a workaround for a race condition of workqueue Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 23/40] staging: comedi: dt282x: fix a null pointer deref on interrupt Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 24/40] staging: comedi: amplc_pci230: fix " Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 25/40] carl9170: fix misuse of device driver API Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 26/40] VMCI: Fix integer overflow in VMCI handle arrays Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 27/40] MIPS: Remove superfluous check for __linux__ Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 28/40] e1000e: start network tx queue only when link is up Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 29/40] perf/core: Fix perf_sample_regs_user() mm check Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 30/40] ARM: omap2: remove incorrect __init annotation Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 31/40] be2net: fix link failure after ethtool offline test Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 32/40] ppp: mppe: Add softdep to arc4 Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 33/40] sis900: fix TX completion Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 34/40] dm verity: use message limit for data block corruption message Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 35/40] kvm: x86: avoid warning on repeated KVM_SET_TSS_ADDR Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 36/40] ARC: hide unused function unw_hdr_alloc Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 37/40] s390: fix stfle zero padding Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 38/40] s390/qdio: (re-)initialize tiqdio list entries Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 39/40] s390/qdio: dont touch the dsci in tiqdio_add_input_queues() Greg Kroah-Hartman
2019-07-18 3:02 ` [PATCH 4.4 40/40] KVM: x86: protect KVM_CREATE_PIT/KVM_CREATE_PIT2 with kvm->lock Greg Kroah-Hartman
2019-07-18 7:33 ` [PATCH 4.4 00/40] 4.4.186-stable review kernelci.org bot
2019-07-18 9:19 ` Jon Hunter
2019-07-18 15:26 ` Naresh Kamboju
2019-07-18 19:47 ` Guenter Roeck
2019-07-18 20:56 ` Kelsey Skunberg
2019-07-19 4:40 ` Bharath Vedartham
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190718030043.255008862@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=bp@alien8.de \
--cc=dianzhangchen0@gmail.com \
--cc=hpa@zytor.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).