diff options
| author | Gustavo A. R. Silva <gustavo@embeddedor.com> | 2018-07-17 20:39:00 +0300 |
|---|---|---|
| committer | Alex Williamson <alex.williamson@redhat.com> | 2018-07-18 21:57:25 +0300 |
| commit | 0e714d27786ce1fb3efa9aac58abc096e68b1c2a (patch) | |
| tree | 0d46cee8004e651a4cab9262d43373f630c23026 /drivers | |
| parent | 9d3cce1e8b8561fed5f383d22a4d6949db4eadbe (diff) | |
| download | linux-0e714d27786ce1fb3efa9aac58abc096e68b1c2a.tar.xz | |
vfio/pci: Fix potential Spectre v1
info.index can be indirectly controlled by user-space, hence leading
to a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/vfio/pci/vfio_pci.c:734 vfio_pci_ioctl()
warn: potential spectre issue 'vdev->region'
Fix this by sanitizing info.index before indirectly using it to index
vdev->region
Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].
[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/vfio/pci/vfio_pci.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index b423a309a6e0..125b58eff936 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -28,6 +28,7 @@ #include <linux/uaccess.h> #include <linux/vfio.h> #include <linux/vgaarb.h> +#include <linux/nospec.h> #include "vfio_pci_private.h" @@ -727,6 +728,9 @@ static long vfio_pci_ioctl(void *device_data, if (info.index >= VFIO_PCI_NUM_REGIONS + vdev->num_regions) return -EINVAL; + info.index = array_index_nospec(info.index, + VFIO_PCI_NUM_REGIONS + + vdev->num_regions); i = info.index - VFIO_PCI_NUM_REGIONS; |