diff options
author | Takashi Iwai <tiwai@suse.de> | 2018-04-24 08:56:07 +0300 |
---|---|---|
committer | Sasha Levin <alexander.levin@microsoft.com> | 2018-05-23 04:36:38 +0300 |
commit | 780b273920078cfbc63143fc695fca1e37b6a176 (patch) | |
tree | c069b923482ed3542c445e3cf2de75c5452b8160 | |
parent | 59af19047988930ff1c6a0dbb42bbe84db7bf42f (diff) | |
download | linux-780b273920078cfbc63143fc695fca1e37b6a176.tar.xz |
ALSA: opl3: Hardening for potential Spectre v1
[ Upstream commit 7f054a5bee0987f1e2d4e59daea462421c76f2cb ]
As recently Smatch suggested, one place in OPL3 driver may expand the
array directly from the user-space value with speculation:
sound/drivers/opl3/opl3_synth.c:476 snd_opl3_set_voice() warn: potential spectre issue 'snd_opl3_regmap'
This patch puts array_index_nospec() for hardening against it.
BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-rw-r--r-- | sound/drivers/opl3/opl3_synth.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c index ddcc1a325a61..42920a243328 100644 --- a/sound/drivers/opl3/opl3_synth.c +++ b/sound/drivers/opl3/opl3_synth.c @@ -21,6 +21,7 @@ #include <linux/slab.h> #include <linux/export.h> +#include <linux/nospec.h> #include <sound/opl3.h> #include <sound/asound_fm.h> @@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v { unsigned short reg_side; unsigned char op_offset; - unsigned char voice_offset; + unsigned char voice_offset, voice_op; unsigned short opl3_reg; unsigned char reg_val; @@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v voice_offset = voice->voice - MAX_OPL2_VOICES; } /* Get register offset of operator */ - op_offset = snd_opl3_regmap[voice_offset][voice->op]; + voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES); + voice_op = array_index_nospec(voice->op, 4); + op_offset = snd_opl3_regmap[voice_offset][voice_op]; reg_val = 0x00; /* Set amplitude modulation (tremolo) effect */ |