Commit 92c4cfae authored by Jordy Zomer's avatar Jordy Zomer Committed by Sumit Semwal
Browse files

dma-buf: heaps: Fix potential spectre v1 gadget 



It appears like nr could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents
of kernel memory from being leaked to userspace via speculative
execution by using array_index_nospec.

Signed-off-by: default avatarJordy Zomer <jordy@pwning.systems>
Fixes: c02a81fb ("dma-buf: Add dma-buf heaps framework")
Cc: <stable@vger.kernel.org> # v5.6+
Acked-by: default avatarJohn Stultz <john.stultz@linaro.org>
Signed-off-by: default avatarSumit Semwal <sumit.semwal@linaro.org>
 [sumits: added fixes and cc: stable tags]
Link: https://patchwork.freedesktop.org/patch/msgid/20220129150604.3461652-1-jordy@pwning.systems
parent 1b777d4d

drivers/dma-buf/dma-heap.c

+2 −0
Original line number Diff line number Diff line
@@ -14,6 +14,7 @@ 
#include <linux/xarray.h>

#include <linux/list.h>

#include <linux/slab.h>

#include <linux/nospec.h>

#include <linux/uaccess.h>

#include <linux/syscalls.h>

#include <linux/dma-heap.h>
@@ -135,6 +136,7 @@ static long dma_heap_ioctl(struct file *file, unsigned int ucmd, 
	if (nr >= ARRAY_SIZE(dma_heap_ioctl_cmds))

		return -EINVAL;



	nr = array_index_nospec(nr, ARRAY_SIZE(dma_heap_ioctl_cmds));

	/* Get the kernel ioctl cmd that matches */

	kcmd = dma_heap_ioctl_cmds[nr];