| From foo@baz Sun Jun 17 12:07:33 CEST 2018 |
| From: Mark Rutland <mark.rutland@arm.com> |
| Date: Wed, 25 Apr 2018 17:13:40 +0100 |
| Subject: arm64: fix possible spectre-v1 in ptrace_hbp_get_event() |
| |
| From: Mark Rutland <mark.rutland@arm.com> |
| |
| [ Upstream commit 19791a7ca674fb3009bb068260e852a2f05b605c ] |
| |
| It's possible for userspace to control idx. Sanitize idx when using it |
| as an array index. |
| |
| Found by smatch. |
| |
| Signed-off-by: Mark Rutland <mark.rutland@arm.com> |
| Cc: Catalin Marinas <catalin.marinas@arm.com> |
| Cc: Will Deacon <will.deacon@arm.com> |
| Signed-off-by: Will Deacon <will.deacon@arm.com> |
| Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/arm64/kernel/ptrace.c | 14 ++++++++++---- |
| 1 file changed, 10 insertions(+), 4 deletions(-) |
| |
| --- a/arch/arm64/kernel/ptrace.c |
| +++ b/arch/arm64/kernel/ptrace.c |
| @@ -25,6 +25,7 @@ |
| #include <linux/sched/signal.h> |
| #include <linux/sched/task_stack.h> |
| #include <linux/mm.h> |
| +#include <linux/nospec.h> |
| #include <linux/smp.h> |
| #include <linux/ptrace.h> |
| #include <linux/user.h> |
| @@ -249,15 +250,20 @@ static struct perf_event *ptrace_hbp_get |
| |
| switch (note_type) { |
| case NT_ARM_HW_BREAK: |
| - if (idx < ARM_MAX_BRP) |
| - bp = tsk->thread.debug.hbp_break[idx]; |
| + if (idx >= ARM_MAX_BRP) |
| + goto out; |
| + idx = array_index_nospec(idx, ARM_MAX_BRP); |
| + bp = tsk->thread.debug.hbp_break[idx]; |
| break; |
| case NT_ARM_HW_WATCH: |
| - if (idx < ARM_MAX_WRP) |
| - bp = tsk->thread.debug.hbp_watch[idx]; |
| + if (idx >= ARM_MAX_WRP) |
| + goto out; |
| + idx = array_index_nospec(idx, ARM_MAX_WRP); |
| + bp = tsk->thread.debug.hbp_watch[idx]; |
| break; |
| } |
| |
| +out: |
| return bp; |
| } |
| |