mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-10-01 14:44:12 +00:00
Code Issues Releases Wiki Activity

Fix spectre v1 vuln in drm_ioctl

Browse source 
-----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEfxcpfMSgdnQMs+QqlvcN/ahKBwoFAlwbydsACgkQlvcN/ahK
 Bwq/SwgAmhFuiScbSxp1CkxlkGwBHisOqeNVIUbgC/2L8nqZvfzDKJgXOCdKo1dr
 m9DF6Clp1NdZiD0W6AR/jwyFlCDaYEWMBSCqsT+pkIjJ5FvftufNoQ+w5ZeKU8l9
 KTI9XPtc9iE0ORxTtRdJaj5X4FVVnpCaWKT2t9Y76Hr+SIVHiim/2v40kvfUhEc1
 0w08iOflqwRoCWUjsVh1geFPwFlhvRVlBrHEX9FtLgaursYDku/OUnqlvM3N4B/I
 kvoOl0YhwFCdqL7ueMOcJq311LEKm3Vcf0giWxHg7CHtduChuXD0LFpc8UseFq6N
 iD6pPsQM3Q1SrRuksVMk3h8Mhg2EbQ==
 =B6OE
 -----END PGP SIGNATURE-----

Merge tag 'drm-misc-fixes-2018-12-20' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes

Fix spectre v1 vuln in drm_ioctl

Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
From: Sean Paul <sean@poorly.run>
Link: https://patchwork.freedesktop.org/patch/msgid/20181220165740.GA42344@art_vandelay
This commit is contained in:
Daniel Vetter 2018-12-20 18:13:53 +01:00
commit b6aac625e5
1 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
drivers/gpu/drm/drm_ioctl.c
View file

@ -37,6 +37,7 @@
#include <linux/pci.h>
#include <linux/export.h>
#include <linux/nospec.h>
/**
* DOC: getunique and setversion story
@ -800,13 +801,17 @@ long drm_ioctl(struct file *filp,
if (is_driver_ioctl) {
/* driver ioctl */
if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
unsigned int index = nr - DRM_COMMAND_BASE;
if (index >= dev->driver->num_ioctls)
goto err_i1;
ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
index = array_index_nospec(index, dev->driver->num_ioctls);
ioctl = &dev->driver->ioctls[index];
} else {
/* core ioctl */
if (nr >= DRM_CORE_IOCTL_COUNT)
goto err_i1;
nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
ioctl = &drm_ioctls[nr];
}
@ -888,6 +893,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)
if (nr >= DRM_CORE_IOCTL_COUNT)
return false;
nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
*flags = drm_ioctls[nr].flags;
return true;