mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-22 17:01:14 +00:00
vmci: prevent speculation leaks by sanitizing event in event_deliver()
commit8003f00d89
upstream. Coverity spotted that event_msg is controlled by user-space, event_msg->event_data.event is passed to event_deliver() and used as an index without sanitization. This change ensures that the event index is sanitized to mitigate any possibility of speculative information leaks. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Only compile tested, no access to HW. Fixes:1d990201f9
("VMCI: event handling implementation.") Cc: stable <stable@kernel.org> Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem@amazon.com> Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
0c1f6e1418
commit
757804e1c5
1 changed files with 5 additions and 1 deletions
|
@ -9,6 +9,7 @@
|
|||
#include <linux/vmw_vmci_api.h>
|
||||
#include <linux/list.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/nospec.h>
|
||||
#include <linux/sched.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/rculist.h>
|
||||
|
@ -86,9 +87,12 @@ static void event_deliver(struct vmci_event_msg *event_msg)
|
|||
{
|
||||
struct vmci_subscription *cur;
|
||||
struct list_head *subscriber_list;
|
||||
u32 sanitized_event, max_vmci_event;
|
||||
|
||||
rcu_read_lock();
|
||||
subscriber_list = &subscriber_array[event_msg->event_data.event];
|
||||
max_vmci_event = ARRAY_SIZE(subscriber_array);
|
||||
sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event);
|
||||
subscriber_list = &subscriber_array[sanitized_event];
|
||||
list_for_each_entry_rcu(cur, subscriber_list, node) {
|
||||
cur->callback(cur->id, &event_msg->event_data,
|
||||
cur->callback_data);
|
||||
|
|
Loading…
Reference in a new issue