Skip to contentSkip to conversation

riscv: Sanitize syscall table indexing under speculation

PATCH New Leon Chen 1 participant 1 message Feb 28 Stable branch

lore
Share & tools
lore

Leon Chen

author
#0 lore raw

PATCH 1/1 riscv: Sanitize syscall table indexing under speculation

From: Lukas Gerlach <[email protected]>

[ Upstream commit 25fd7ee7bf58ac3ec7be3c9f82ceff153451946c ]

The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels.

Signed-off-by Lukas Gerlach <[email protected]>
Link https://patch.msgid.link/[email protected] open here
Signed-off-by Paul Walmsley <[email protected]>
[ Added linux/nospec.h for array_index_nospec() to make sure compile without error ]
Signed-off-by Leon Chen <[email protected]>
---
 arch/riscv/kernel/traps.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
arch/riscv/kernel/traps.c +4 -1
index 53c7de4878c2..314c4d7671ca 100644
@@ -20,6 +20,7 @@
 #include <linux/irq.h>
 #include <linux/kexec.h>
 #include <linux/entry-common.h>
+#include <linux/nospec.h>
 
 #include <asm/asm-prototypes.h>
 #include <asm/bug.h>

@@ -317,8 +318,10 @@ asmlinkage __visible __trap_section void do_trap_ecall_u(struct pt_regs *regs)
 
 		syscall = syscall_enter_from_user_mode(regs, syscall);
 
-		if (syscall >= 0 && syscall < NR_syscalls)
+		if (syscall >= 0 && syscall < NR_syscalls) {
+			syscall = array_index_nospec(syscall, NR_syscalls);
 			syscall_handler(regs, syscall);
+		}
 
 		syscall_exit_to_user_mode(regs);
 	} else {
Signature · 1 line
2.35.3