drm/ioc32: stop speculation on the drm_compat_ioctl path
Subsystems (2)
PATCH 1/1 drm/ioc32: stop speculation on the drm_compat_ioctl path
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling array_index_nospec() on the index to the function pointer list.
---
My scripts caught this codepath as not being "protected" for the old-school spectre attack. I don't know how realistic it is, but it seems like this is the correct thing to be doing for a 32bit ioctl on the drm path, as "local" users can make these.
drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/gpu/drm/drm_ioc32.c +2 -0
@@ -28,6 +28,7 @@* IN THE SOFTWARE. */ #include <linux/compat.h> +#include <linux/nospec.h> #include <linux/ratelimit.h> #include <linux/export.h>
@@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)if (nr >=ARRAY_SIZE (drm_compat_ioctls))return drm_ioctl (filp, cmd, arg); + nr =array_index_nospec (nr,ARRAY_SIZE (drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn;if (!fn)return drm_ioctl (filp, cmd, arg);
Signature · 1 line
2.53.0
Am 24.03.26 um 17:42 schrieb Greg Kroah-Hartman:
Quoted 13 lines
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling
array_index_nospec()on the index to the function pointer list.Cc Maarten Lankhorst <[email protected]>Cc Maxime Ripard <[email protected]>Cc Thomas Zimmermann <[email protected]>Cc David Airlie <[email protected]>Cc Simona Vetter <[email protected]>Cc stable <[email protected]>Assisted-by gkh_clanker_2000Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 5 lines
---
My scripts caught this codepath as not being "protected" for the old-school spectre attack. I don't know how realistic it is, but it seems like this is the correct thing to be doing for a 32bit ioctl on the drm path, as "local" users can make these.
Seems reasonable.
Quoted 24 lines
drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+)drivers/gpu/drm/drm_ioc32.c +2
-0@@ -28,6 +28,7 @@* IN THE SOFTWARE. */ #include <linux/compat.h> +#include <linux/nospec.h> #include <linux/ratelimit.h> #include <linux/export.h> @@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)if (nr >=ARRAY_SIZE (drm_compat_ioctls))return drm_ioctl (filp, cmd, arg); + nr =array_index_nospec (nr,ARRAY_SIZE (drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn;if (!fn)return drm_ioctl (filp, cmd, arg);
Signature · 6 lines
-- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
Am 24.03.26 um 17:42 schrieb Greg Kroah-Hartman:
Quoted 5 lines
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling
array_index_nospec()on the index to the function pointer list.
Quoted 8 lines
Cc Maarten Lankhorst <[email protected]>Cc Maxime Ripard <[email protected]>Cc Thomas Zimmermann <[email protected]>Cc David Airlie <[email protected]>Cc Simona Vetter <[email protected]>Cc stable <[email protected]>Assisted-by gkh_clanker_2000Signed-off-by Greg Kroah-Hartman <[email protected]>
Also acked by Sima and Maxime via IRC
Quoted 29 lines
---
My scripts caught this codepath as not being "protected" for the old-school spectre attack. I don't know how realistic it is, but it seems like this is the correct thing to be doing for a 32bit ioctl on the drm path, as "local" users can make these.drivers/gpu/drm/drm_ioc32.c | 2 ++ 1 file changed, 2 insertions(+)drivers/gpu/drm/drm_ioc32.c +2
-0@@ -28,6 +28,7 @@* IN THE SOFTWARE. */ #include <linux/compat.h> +#include <linux/nospec.h> #include <linux/ratelimit.h> #include <linux/export.h> @@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)if (nr >=ARRAY_SIZE (drm_compat_ioctls))return drm_ioctl (filp, cmd, arg); + nr =array_index_nospec (nr,ARRAY_SIZE (drm_compat_ioctls)); fn = drm_compat_ioctls[nr].fn;if (!fn)return drm_ioctl (filp, cmd, arg);
Signature · 6 lines
-- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)
Quoted 17 lines · Thomas Zimmermann
Am 24.03.26 um 17:42 schrieb Greg Kroah-Hartman:
Quoted 5 lines
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling
array_index_nospec()on the index to the function pointer list.Quoted 8 lines
Cc Maarten Lankhorst <[email protected]>Cc Maxime Ripard <[email protected]>Cc Thomas Zimmermann <[email protected]>Cc David Airlie <[email protected]>Cc Simona Vetter <[email protected]>Cc stable <[email protected]>Assisted-by gkh_clanker_2000Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 6 lines
Also acked by Sima and Maxime via IRC
Acked-by Maxime Ripard <[email protected]>Reviewed-by Simona Vetter <[email protected]>
Great, thanks, I'm assuming some drm developer can pick this up then?
greg k-h
Thomas Zimmermann
maintainerAm 02.04.26 um 08:32 schrieb Greg Kroah-Hartman:
Quoted 16 lines · Thomas Zimmermann
Quoted 15 lines
Am 24.03.26 um 17:42 schrieb Greg Kroah-Hartman:
Quoted 13 lines
The drm compat ioctl path takes a user controlled pointer, and then dereferences it into a table of function pointers, the signature method of spectre problems. Fix this up by calling
array_index_nospec()on the index to the function pointer list.Cc Maarten Lankhorst <[email protected]>Cc Maxime Ripard <[email protected]>Cc Thomas Zimmermann <[email protected]>Cc David Airlie <[email protected]>Cc Simona Vetter <[email protected]>Cc stable <[email protected]>Assisted-by gkh_clanker_2000Signed-off-by Greg Kroah-Hartman <[email protected]>
Quoted 7 lines
Quoted 6 lines
Also acked by Sima and Maxime via IRC
Acked-by Maxime Ripard <[email protected]>Reviewed-by Simona Vetter <[email protected]>Great, thanks, I'm assuming some drm developer can pick this up then?
Already done. It should show up in the next -rc
Quoted 2 lines
greg k-h
Signature · 6 lines
-- Thomas Zimmermann Graphics Driver Developer SUSE Software Solutions Germany GmbH Frankenstr. 146, 90461 Nürnberg, Germany, www.suse.com GF: Jochen Jaser, Andrew McDonald, Werner Knoblich, (HRB 36809, AG Nürnberg)