mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-14 12:37:32 +00:00
HID: hiddev: fix potential Spectre v1
commit f11274396a
upstream.
uref->usage_index can be indirectly controlled by userspace, hence leading
to a potential exploitation of the Spectre variant 1 vulnerability.
This field is used as an array index by the hiddev_ioctl_usage() function,
when 'cmd' is either HIDIOCGCOLLECTIONINDEX, HIDIOCGUSAGES or
HIDIOCSUSAGES.
For cmd == HIDIOCGCOLLECTIONINDEX case, uref->usage_index is compared to
field->maxusage and then used as an index to dereference field->usage
array. The same thing happens to the cmd == HIDIOC{G,S}USAGES cases, where
uref->usage_index is checked against an array maximum value and then it is
used as an index in an array.
This is a summary of the HIDIOCGCOLLECTIONINDEX case, which matches the
traditional Spectre V1 first load:
copy_from_user(uref, user_arg, sizeof(*uref))
if (uref->usage_index >= field->maxusage)
goto inval;
i = field->usage[uref->usage_index].collection_index;
return i;
This patch fixes this by sanitizing field uref->usage_index before using it
to index field->usage (HIDIOCGCOLLECTIONINDEX) or field->value in
HIDIOC{G,S}USAGES arrays, thus, avoiding speculation in the first load.
Cc: <stable@vger.kernel.org>
Signed-off-by: Breno Leitao <leitao@debian.org>
v2: Contemplate cmd == HIDIOC{G,S}USAGES case
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
44dcd01ee1
commit
872f9d8665
1 changed files with 14 additions and 4 deletions
|
@ -512,14 +512,24 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd,
|
||||||
if (cmd == HIDIOCGCOLLECTIONINDEX) {
|
if (cmd == HIDIOCGCOLLECTIONINDEX) {
|
||||||
if (uref->usage_index >= field->maxusage)
|
if (uref->usage_index >= field->maxusage)
|
||||||
goto inval;
|
goto inval;
|
||||||
|
uref->usage_index =
|
||||||
|
array_index_nospec(uref->usage_index,
|
||||||
|
field->maxusage);
|
||||||
} else if (uref->usage_index >= field->report_count)
|
} else if (uref->usage_index >= field->report_count)
|
||||||
goto inval;
|
goto inval;
|
||||||
}
|
}
|
||||||
|
|
||||||
if ((cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) &&
|
if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
|
||||||
(uref_multi->num_values > HID_MAX_MULTI_USAGES ||
|
if (uref_multi->num_values > HID_MAX_MULTI_USAGES ||
|
||||||
uref->usage_index + uref_multi->num_values > field->report_count))
|
uref->usage_index + uref_multi->num_values >
|
||||||
goto inval;
|
field->report_count)
|
||||||
|
goto inval;
|
||||||
|
|
||||||
|
uref->usage_index =
|
||||||
|
array_index_nospec(uref->usage_index,
|
||||||
|
field->report_count -
|
||||||
|
uref_multi->num_values);
|
||||||
|
}
|
||||||
|
|
||||||
switch (cmd) {
|
switch (cmd) {
|
||||||
case HIDIOCGUSAGE:
|
case HIDIOCGUSAGE:
|
||||||
|
|
Loading…
Reference in a new issue