From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932416AbeDWSBz (ORCPT ); Mon, 23 Apr 2018 14:01:55 -0400 Received: from gateway36.websitewelcome.com ([192.185.198.13]:40511 "EHLO gateway36.websitewelcome.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932306AbeDWSBt (ORCPT ); Mon, 23 Apr 2018 14:01:49 -0400 X-Authority-Reason: nr=8 Date: Mon, 23 Apr 2018 12:39:21 -0500 From: "Gustavo A. R. Silva" To: Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, "Gustavo A. R. Silva" , Dan Carpenter Subject: [PATCH 03/11] fsl-viu: fix potential Spectre variant 1 Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - gator4166.hostgator.com X-AntiAbuse: Original Domain - vger.kernel.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - embeddedor.com X-BWhitelist: no X-Source-IP: 189.145.48.65 X-Source-L: No X-Exim-ID: 1fAfQv-004MgT-Pd X-Source: X-Source-Args: X-Source-Dir: X-Source-Sender: (embeddedor) [189.145.48.65]:49548 X-Source-Auth: gustavo@embeddedor.com X-Email-Count: 33 X-Source-Cap: Z3V6aWRpbmU7Z3V6aWRpbmU7Z2F0b3I0MTY2Lmhvc3RnYXRvci5jb20= X-Local-Domain: yes Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org f->index can be controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. Smatch warning: drivers/media/platform/fsl-viu.c:587 vidioc_enum_fmt() warn: potential spectre issue 'formats' Fix this by sanitizing f->index before using it to index formats. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Signed-off-by: Gustavo A. R. Silva --- drivers/media/platform/fsl-viu.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c index e41510c..8356d26 100644 --- a/drivers/media/platform/fsl-viu.c +++ b/drivers/media/platform/fsl-viu.c @@ -33,6 +33,8 @@ #include #include +#include + #define DRV_NAME "fsl_viu" #define VIU_VERSION "0.5.1" @@ -579,12 +581,10 @@ static int vidioc_querycap(struct file *file, void *priv, static int vidioc_enum_fmt(struct file *file, void *priv, struct v4l2_fmtdesc *f) { - int index = f->index; - if (f->index >= NUM_FORMATS) return -EINVAL; - - f->pixelformat = formats[index].fourcc; + f->index = array_index_nospec(f->index, NUM_FORMATS); + f->pixelformat = formats[f->index].fourcc; return 0; } -- 2.7.4