summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJordy Zomer <jordyzomer@google.com>2023-06-17 14:38:28 +0300
committerJens Axboe <axboe@kernel.dk>2023-06-22 16:48:08 +0300
commit8270cb10c0681d52fce508f827dfa1688d3acc3a (patch)
treea46a3a289f8d0cee96cde9de7aeb44aa8178d264
parent017fb83ee0612595ec70c65ddd83472706b02a50 (diff)
downloadlinux-8270cb10c0681d52fce508f827dfa1688d3acc3a.tar.xz
cdrom: Fix spectre-v1 gadget
This patch fixes a spectre-v1 gadget in cdrom. The gadget could be triggered by speculatively bypassing the cdi->capacity check. Signed-off-by: Jordy Zomer <jordyzomer@google.com> Link: https://lore.kernel.org/all/20230612110040.849318-2-jordyzomer@google.com Reviewed-by: Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/all/ZI1+1OG9Ut1MqsUC@equinox Signed-off-by: Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/r/20230617113828.1230-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--drivers/cdrom/cdrom.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index bd8cd59c758a..cc2839805983 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -264,6 +264,7 @@
#include <linux/errno.h>
#include <linux/kernel.h>
#include <linux/mm.h>
+#include <linux/nospec.h>
#include <linux/slab.h>
#include <linux/cdrom.h>
#include <linux/sysctl.h>
@@ -2311,6 +2312,9 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
if (arg >= cdi->capacity)
return -EINVAL;
+ /* Prevent arg from speculatively bypassing the length check */
+ barrier_nospec();
+
info = kmalloc(sizeof(*info), GFP_KERNEL);
if (!info)
return -ENOMEM;