diff options
| author | Jordy Zomer <jordyzomer@google.com> | 2023-06-17 14:38:28 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2023-06-22 16:48:08 +0300 |
| commit | 8270cb10c0681d52fce508f827dfa1688d3acc3a (patch) | |
| tree | a46a3a289f8d0cee96cde9de7aeb44aa8178d264 | |
| parent | 017fb83ee0612595ec70c65ddd83472706b02a50 (diff) | |
| download | linux-8270cb10c0681d52fce508f827dfa1688d3acc3a.tar.xz | |
cdrom: Fix spectre-v1 gadget
This patch fixes a spectre-v1 gadget in cdrom.
The gadget could be triggered by speculatively
bypassing the cdi->capacity check.
Signed-off-by: Jordy Zomer <jordyzomer@google.com>
Link: https://lore.kernel.org/all/20230612110040.849318-2-jordyzomer@google.com
Reviewed-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/all/ZI1+1OG9Ut1MqsUC@equinox
Signed-off-by: Phillip Potter <phil@philpotter.co.uk>
Link: https://lore.kernel.org/r/20230617113828.1230-2-phil@philpotter.co.uk
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | drivers/cdrom/cdrom.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index bd8cd59c758a..cc2839805983 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -264,6 +264,7 @@ #include <linux/errno.h> #include <linux/kernel.h> #include <linux/mm.h> +#include <linux/nospec.h> #include <linux/slab.h> #include <linux/cdrom.h> #include <linux/sysctl.h> @@ -2311,6 +2312,9 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi, if (arg >= cdi->capacity) return -EINVAL; + /* Prevent arg from speculatively bypassing the length check */ + barrier_nospec(); + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return -ENOMEM; |