usbip: vhci_sysfs: fix potential Spectre v1
commit a0d6ec8809
upstream.
pdev_nr and rhport can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/usb/usbip/vhci_sysfs.c:238 detach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:328 attach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:338 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_ss->vdev'
drivers/usb/usbip/vhci_sysfs.c:340 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_hs->vdev'
Fix this by sanitizing pdev_nr and rhport before using them to index
vhcis and vhci->vhci_hcd_ss->vdev respectively.
Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].
[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Shuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
parent
1caeb50224
commit
f31eb7298b
|
@ -24,6 +24,9 @@
|
|||
#include <linux/platform_device.h>
|
||||
#include <linux/slab.h>
|
||||
|
||||
/* Hardening for Spectre-v1 */
|
||||
#include <linux/nospec.h>
|
||||
|
||||
#include "usbip_common.h"
|
||||
#include "vhci.h"
|
||||
|
||||
|
@ -219,16 +222,20 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport)
|
|||
return 0;
|
||||
}
|
||||
|
||||
static int valid_port(__u32 pdev_nr, __u32 rhport)
|
||||
static int valid_port(__u32 *pdev_nr, __u32 *rhport)
|
||||
{
|
||||
if (pdev_nr >= vhci_num_controllers) {
|
||||
pr_err("pdev %u\n", pdev_nr);
|
||||
if (*pdev_nr >= vhci_num_controllers) {
|
||||
pr_err("pdev %u\n", *pdev_nr);
|
||||
return 0;
|
||||
}
|
||||
if (rhport >= VHCI_HC_PORTS) {
|
||||
pr_err("rhport %u\n", rhport);
|
||||
*pdev_nr = array_index_nospec(*pdev_nr, vhci_num_controllers);
|
||||
|
||||
if (*rhport >= VHCI_HC_PORTS) {
|
||||
pr_err("rhport %u\n", *rhport);
|
||||
return 0;
|
||||
}
|
||||
*rhport = array_index_nospec(*rhport, VHCI_HC_PORTS);
|
||||
|
||||
return 1;
|
||||
}
|
||||
|
||||
|
@ -246,7 +253,7 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr,
|
|||
pdev_nr = port_to_pdev_nr(port);
|
||||
rhport = port_to_rhport(port);
|
||||
|
||||
if (!valid_port(pdev_nr, rhport))
|
||||
if (!valid_port(&pdev_nr, &rhport))
|
||||
return -EINVAL;
|
||||
|
||||
hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);
|
||||
|
@ -272,7 +279,8 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr,
|
|||
}
|
||||
static DEVICE_ATTR(detach, S_IWUSR, NULL, store_detach);
|
||||
|
||||
static int valid_args(__u32 pdev_nr, __u32 rhport, enum usb_device_speed speed)
|
||||
static int valid_args(__u32 *pdev_nr, __u32 *rhport,
|
||||
enum usb_device_speed speed)
|
||||
{
|
||||
if (!valid_port(pdev_nr, rhport)) {
|
||||
return 0;
|
||||
|
@ -336,7 +344,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr,
|
|||
sockfd, devid, speed);
|
||||
|
||||
/* check received parameters */
|
||||
if (!valid_args(pdev_nr, rhport, speed))
|
||||
if (!valid_args(&pdev_nr, &rhport, speed))
|
||||
return -EINVAL;
|
||||
|
||||
hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);
|
||||
|
|
Loading…
Reference in New Issue