Messages in this thread | | | Date | Thu, 13 Dec 2018 09:13:44 +0100 | From | Takashi Iwai <> | Subject | Re: [PATCH] ALSA: emux_hwdep: Fix potential Spectre v1 vulnerabilities |
| |
On Wed, 12 Dec 2018 18:20:49 +0100, Gustavo A. R. Silva wrote: > > info.mode and info.port are indirectly controlled by user-space, > hence leading to a potential exploitation of the Spectre variant 1 > vulnerability. > > These issues were detected with the help of Smatch: > > sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap) > sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap) > sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap) > > Fix this by sanitizing both info.mode and info.port before using them > to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and > emu->portptrs. > > Notice that given that speculation windows are large, the policy is > to kill the speculation on the first load and not worry if it can be > completed with a dependent load/store [1]. > > [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 > > Cc: stable@vger.kernel.org > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Applied now (with moving the linux/nospec.h in a more appropriate line).
thanks,
Takashi
| |