| From 3b8abe006b542895624f9dd6ba9999f19f337aa6 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Sat, 29 Jan 2022 15:58:39 +0100 |
| Subject: dm ioctl: prevent potential spectre v1 gadget |
| |
| From: Jordy Zomer <jordy@jordyzomer.github.io> |
| |
| [ Upstream commit cd9c88da171a62c4b0f1c70e50c75845969fbc18 ] |
| |
| It appears like cmd could be a Spectre v1 gadget as it's supplied by a |
| user and used as an array index. Prevent the contents of kernel memory |
| from being leaked to userspace via speculative execution by using |
| array_index_nospec. |
| |
| Signed-off-by: Jordy Zomer <jordy@pwning.systems> |
| Signed-off-by: Mike Snitzer <snitzer@redhat.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/md/dm-ioctl.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c |
| index 2f020401d5ba..ddfea5324b58 100644 |
| --- a/drivers/md/dm-ioctl.c |
| +++ b/drivers/md/dm-ioctl.c |
| @@ -17,6 +17,7 @@ |
| #include <linux/dm-ioctl.h> |
| #include <linux/hdreg.h> |
| #include <linux/compat.h> |
| +#include <linux/nospec.h> |
| |
| #include <linux/uaccess.h> |
| |
| @@ -1669,6 +1670,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) |
| if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) |
| return NULL; |
| |
| + cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); |
| *ioctl_flags = _ioctls[cmd].flags; |
| return _ioctls[cmd].fn; |
| } |
| -- |
| 2.35.1 |
| |
