| From d49dbfade96d5b0863ca8a90122a805edd5ef50a Mon Sep 17 00:00:00 2001 |
| From: "Gustavo A. R. Silva" <gustavo@embeddedor.com> |
| Date: Wed, 15 Aug 2018 08:14:37 -0500 |
| Subject: hwmon: (nct6775) Fix potential Spectre v1 |
| |
| From: Gustavo A. R. Silva <gustavo@embeddedor.com> |
| |
| commit d49dbfade96d5b0863ca8a90122a805edd5ef50a upstream. |
| |
| val can be indirectly controlled by user-space, hence leading to |
| a potential exploitation of the Spectre variant 1 vulnerability. |
| |
| This issue was detected with the help of Smatch: |
| |
| vers/hwmon/nct6775.c:2698 store_pwm_weight_temp_sel() warn: potential |
| spectre issue 'data->temp_src' [r] |
| |
| Fix this by sanitizing val before using it to index data->temp_src |
| |
| Notice that given that speculation windows are large, the policy is |
| to kill the speculation on the first load and not worry if it can be |
| completed with a dependent load/store [1]. |
| |
| [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 |
| |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> |
| Signed-off-by: Guenter Roeck <linux@roeck-us.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/hwmon/nct6775.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/drivers/hwmon/nct6775.c |
| +++ b/drivers/hwmon/nct6775.c |
| @@ -63,6 +63,7 @@ |
| #include <linux/bitops.h> |
| #include <linux/dmi.h> |
| #include <linux/io.h> |
| +#include <linux/nospec.h> |
| #include "lm75.h" |
| |
| #define USE_ALTERNATE |
| @@ -2642,6 +2643,7 @@ store_pwm_weight_temp_sel(struct device |
| return err; |
| if (val > NUM_TEMP) |
| return -EINVAL; |
| + val = array_index_nospec(val, NUM_TEMP + 1); |
| if (val && (!(data->have_temp & BIT(val - 1)) || |
| !data->temp_src[val - 1])) |
| return -EINVAL; |
