| From: Takashi Iwai <tiwai@suse.de> |
| Date: Tue, 24 Apr 2018 07:50:50 +0200 |
| Subject: ALSA: hda: Hardening for potential Spectre v1 |
| |
| commit 69fa6f19b95597618ab30438a27b67ad93daa7c7 upstream. |
| |
| As recently Smatch suggested, one place in HD-audio hwdep ioctl codes |
| may expand the array directly from the user-space value with |
| speculation: |
| sound/pci/hda/hda_local.h:467 get_wcaps() warn: potential spectre issue 'codec->wcaps' |
| |
| As get_wcaps() itself is a fairly frequently called inline function, |
| and there is only one single call with a user-space value, we replace |
| only the latter one to open-code locally with array_index_nospec() |
| hardening in this patch. |
| |
| BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 |
| Reported-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Takashi Iwai <tiwai@suse.de> |
| [bwh: Backported to 3.16: s/core\.//g] |
| Signed-off-by: Ben Hutchings <ben@decadent.org.uk> |
| --- |
| sound/pci/hda/hda_hwdep.c | 12 +++++++++++- |
| 1 file changed, 11 insertions(+), 1 deletion(-) |
| |
| --- a/sound/pci/hda/hda_hwdep.c |
| +++ b/sound/pci/hda/hda_hwdep.c |
| @@ -21,6 +21,7 @@ |
| #include <linux/init.h> |
| #include <linux/slab.h> |
| #include <linux/compat.h> |
| +#include <linux/nospec.h> |
| #include <sound/core.h> |
| #include "hda_codec.h" |
| #include "hda_local.h" |
| @@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_cod |
| |
| if (get_user(verb, &arg->verb)) |
| return -EFAULT; |
| - res = get_wcaps(codec, verb >> 24); |
| + /* open-code get_wcaps(verb>>24) with nospec */ |
| + verb >>= 24; |
| + if (verb < codec->start_nid || |
| + verb >= codec->start_nid + codec->num_nodes) { |
| + res = 0; |
| + } else { |
| + verb -= codec->start_nid; |
| + verb = array_index_nospec(verb, codec->num_nodes); |
| + res = codec->wcaps[verb]; |
| + } |
| if (put_user(res, &arg->res)) |
| return -EFAULT; |
| return 0; |
