lkml.org 
[lkml]   [2019]   [Aug]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 078/103] IB/core: Add mitigation for Spectre V1
    Date
    [ Upstream commit 61f259821dd3306e49b7d42a3f90fb5a4ff3351b ]

    Some processors may mispredict an array bounds check and
    speculatively access memory that they should not. With
    a user supplied array index we like to play things safe
    by masking the value with the array size before it is
    used as an index.

    Signed-off-by: Tony Luck <tony.luck@intel.com>
    Link: https://lore.kernel.org/r/20190731043957.GA1600@agluck-desk2.amr.corp.intel.com
    Signed-off-by: Doug Ledford <dledford@redhat.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/core/user_mad.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
    index 415a3185cde7f..cf93a96b63249 100644
    --- a/drivers/infiniband/core/user_mad.c
    +++ b/drivers/infiniband/core/user_mad.c
    @@ -49,6 +49,7 @@
    #include <linux/sched.h>
    #include <linux/semaphore.h>
    #include <linux/slab.h>
    +#include <linux/nospec.h>

    #include <asm/uaccess.h>

    @@ -843,11 +844,14 @@ static int ib_umad_unreg_agent(struct ib_umad_file *file, u32 __user *arg)

    if (get_user(id, arg))
    return -EFAULT;
    + if (id >= IB_UMAD_MAX_AGENTS)
    + return -EINVAL;

    mutex_lock(&file->port->file_mutex);
    mutex_lock(&file->mutex);

    - if (id >= IB_UMAD_MAX_AGENTS || !__get_agent(file, id)) {
    + id = array_index_nospec(id, IB_UMAD_MAX_AGENTS);
    + if (!__get_agent(file, id)) {
    ret = -EINVAL;
    goto out;
    }
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-08-22 19:39    [W:4.027 / U:0.552 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site