atm: iphase: Fix Spectre v1 vulnerability
Subsystems (3)
PATCH 1/1 atm: iphase: Fix Spectre v1 vulnerability
board is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/atm/iphase.c:2765 ia_ioctl() warn: potential spectre issue 'ia_dev' [r] (local cap)
drivers/atm/iphase.c:2774 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2782 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2816 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2823 ia_ioctl() warn: possible spectre second half. 'iadev'
drivers/atm/iphase.c:2830 ia_ioctl() warn: potential spectre issue '_ia_dev' [r] (local cap) drivers/atm/iphase.c:2845 ia_ioctl() warn: possible spectre second half. 'iadev' drivers/atm/iphase.c:2856 ia_ioctl() warn: possible spectre second half. 'iadev'
Fix this by sanitizing board before using it to index ia_dev and _ia_dev
Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1].
[1] https://lore.kernel.org/lkml/[email protected]/
--- drivers/atm/iphase.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
drivers/atm/iphase.c +6 -2
@@ -63,6 +63,7 @@#include <asm/byteorder.h> #include <linux/vmalloc.h> #include <linux/jiffies.h> +#include <linux/nospec.h> #include "iphase.h" #include "suni.h" #define swap_byte_order (x) (((x & 0xff) << 8) | ((x & 0xff00) >> 8))
@@ -2760,8 +2761,11 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg) }if (copy_from_user (&ia_cmds, arg,sizeof ia_cmds))return -EFAULT ; board = ia_cmds.status; -if ((board <0 ) || (board > iadev_count)) - board =0 ; + +if ((board <0 ) || (board > iadev_count)) + board =0 ; + board =array_index_nospec (board, iadev_count +1 ); + iadev = ia_dev[board];switch (ia_cmds.cmd) {case MEMDUMP :
Signature · 1 line
2.22.0
David Miller
maintainerFrom: "Gustavo A. R. Silva" <[email protected]>
Date: Tue, 30 Jul 2019 22:21:41 -0500
Quoted 4 lines
board is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
Applied and queued up for -stable.
Do not CC: -stable for networking fixes, we take care of the stable submissions manually for this subsystem.
Thank you.
Hi Dave,
Quoted 6 lines · David Miller
From: "Gustavo A. R. Silva" <[email protected]>
Date: Tue, 30 Jul 2019 22:21:41 -0500Quoted 3 lines
board is controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability.
Quoted 7 lines
Quoted 1 line
This issue was detected with the help of Smatch:
Applied and queued up for -stable.
Do not CC: -stable for networking fixes, we take care of the stable submissions manually for this subsystem.
Yeah. I'm aware of that. The thing is that you don't appear as a maintainer of this file:
$ scripts/get_maintainer.pl --nokeywords --nogit --nogit-fallback -f drivers/atm/iphase.c Chas Williams <[email protected]> (maintainer:ATM) [email protected] (moderated list:ATM) [email protected] (open list:ATM) [email protected] (open list)
so, I didn't know this patch would be applied to net.
Thanks
--
Gustavo