mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
ALSA: emux: Fix potential Spectre v1 vulnerabilities
info.mode and info.port are indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. These issues were detected with the help of Smatch: sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap) sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap) sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap) Fix this by sanitizing both info.mode and info.port before using them to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and emu->portptrs. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Cc: stable@vger.kernel.org Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
parent
c7072f5f2a
commit
4aea96f423
1 changed files with 5 additions and 2 deletions
|
@ -22,9 +22,9 @@
|
||||||
#include <sound/core.h>
|
#include <sound/core.h>
|
||||||
#include <sound/hwdep.h>
|
#include <sound/hwdep.h>
|
||||||
#include <linux/uaccess.h>
|
#include <linux/uaccess.h>
|
||||||
|
#include <linux/nospec.h>
|
||||||
#include "emux_voice.h"
|
#include "emux_voice.h"
|
||||||
|
|
||||||
|
|
||||||
#define TMP_CLIENT_ID 0x1001
|
#define TMP_CLIENT_ID 0x1001
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -66,13 +66,16 @@ snd_emux_hwdep_misc_mode(struct snd_emux *emu, void __user *arg)
|
||||||
return -EFAULT;
|
return -EFAULT;
|
||||||
if (info.mode < 0 || info.mode >= EMUX_MD_END)
|
if (info.mode < 0 || info.mode >= EMUX_MD_END)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
|
info.mode = array_index_nospec(info.mode, EMUX_MD_END);
|
||||||
|
|
||||||
if (info.port < 0) {
|
if (info.port < 0) {
|
||||||
for (i = 0; i < emu->num_ports; i++)
|
for (i = 0; i < emu->num_ports; i++)
|
||||||
emu->portptrs[i]->ctrls[info.mode] = info.value;
|
emu->portptrs[i]->ctrls[info.mode] = info.value;
|
||||||
} else {
|
} else {
|
||||||
if (info.port < emu->num_ports)
|
if (info.port < emu->num_ports) {
|
||||||
|
info.port = array_index_nospec(info.port, emu->num_ports);
|
||||||
emu->portptrs[info.port]->ctrls[info.mode] = info.value;
|
emu->portptrs[info.port]->ctrls[info.mode] = info.value;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue