| From foo@baz Fri Nov 2 10:04:04 CET 2018 |
| From: Jason Wang <jasowang@redhat.com> |
| Date: Tue, 30 Oct 2018 14:10:49 +0800 |
| Subject: vhost: Fix Spectre V1 vulnerability |
| |
| From: Jason Wang <jasowang@redhat.com> |
| |
| [ Upstream commit ff002269a4ee9c769dbf9365acef633ebcbd6cbe ] |
| |
| The idx in vhost_vring_ioctl() was controlled by userspace, hence a |
| potential exploitation of the Spectre variant 1 vulnerability. |
| |
| Fixing this by sanitizing idx before using it to index d->vqs. |
| |
| Cc: Michael S. Tsirkin <mst@redhat.com> |
| Cc: Josh Poimboeuf <jpoimboe@redhat.com> |
| Cc: Andrea Arcangeli <aarcange@redhat.com> |
| Signed-off-by: Jason Wang <jasowang@redhat.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/vhost/vhost.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| --- a/drivers/vhost/vhost.c |
| +++ b/drivers/vhost/vhost.c |
| @@ -28,6 +28,7 @@ |
| #include <linux/module.h> |
| #include <linux/sort.h> |
| #include <linux/interval_tree_generic.h> |
| +#include <linux/nospec.h> |
| |
| #include "vhost.h" |
| |
| @@ -1289,6 +1290,7 @@ long vhost_vring_ioctl(struct vhost_dev |
| if (idx >= d->nvqs) |
| return -ENOBUFS; |
| |
| + idx = array_index_nospec(idx, d->nvqs); |
| vq = d->vqs[idx]; |
| |
| mutex_lock(&vq->mutex); |
