From nobody Mon Jun 29 22:20:18 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D9563C433EF for ; Tue, 1 Feb 2022 17:24:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241464AbiBARY7 (ORCPT ); Tue, 1 Feb 2022 12:24:59 -0500 Received: from mta-12-4.privateemail.com ([198.54.127.107]:33003 "EHLO MTA-12-4.privateemail.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229836AbiBARY6 (ORCPT ); Tue, 1 Feb 2022 12:24:58 -0500 Received: from mta-12.privateemail.com (localhost [127.0.0.1]) by mta-12.privateemail.com (Postfix) with ESMTP id 5C20F18000A1; Tue, 1 Feb 2022 12:24:57 -0500 (EST) Received: from localhost.localdomain (unknown [10.20.151.177]) by mta-12.privateemail.com (Postfix) with ESMTPA id 9F69918000A5; Tue, 1 Feb 2022 12:24:54 -0500 (EST) From: Jordy Zomer To: linux-kernel@vger.kernel.org Cc: Jordy Zomer , Oded Gabbay , Arnd Bergmann , Greg Kroah-Hartman , Ofir Bitton , Dani Liberman , Tomer Tayar , Koby Elbaz , farah kassabri , Sagiv Ozeri , Yuri Nudelman Subject: [PATCH] habanalabs: fix potential spectre v1 gadgets Date: Tue, 1 Feb 2022 18:24:21 +0100 Message-Id: <20220201172424.3509544-1-jordy@pwning.systems> X-Mailer: git-send-email 2.27.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Virus-Scanned: ClamAV using ClamSMTP Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory from being leaked to userspace via speculative execution by using array_index_nospec. Signed-off-by: Jordy Zomer --- drivers/misc/habanalabs/common/habanalabs_ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/mi= sc/habanalabs/common/habanalabs_ioctl.c index 3ba3a8ffda3e..c1cdf712a10d 100644 --- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c +++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c @@ -14,6 +14,7 @@ #include #include #include +#include =20 static u32 hl_debug_struct_size[HL_DEBUG_OP_TIMESTAMP + 1] =3D { [HL_DEBUG_OP_ETR] =3D sizeof(struct hl_debug_params_etr), @@ -849,6 +850,7 @@ long hl_ioctl(struct file *filep, unsigned int cmd, uns= igned long arg) } =20 if ((nr >=3D HL_COMMAND_START) && (nr < HL_COMMAND_END)) { + nr =3D array_index_nospec(nr, HL_COMMAND_END-1); ioctl =3D &hl_ioctls[nr]; } else { dev_err(hdev->dev, "invalid ioctl: pid=3D%d, nr=3D0x%02x\n", @@ -872,6 +874,7 @@ long hl_ioctl_control(struct file *filep, unsigned int = cmd, unsigned long arg) } =20 if (nr =3D=3D _IOC_NR(HL_IOCTL_INFO)) { + nr =3D array_index_nospec(nr, _IOC_NR(HL_IOCTL_INFO)); ioctl =3D &hl_ioctls_control[nr]; } else { dev_err(hdev->dev_ctrl, "invalid ioctl: pid=3D%d, nr=3D0x%02x\n", --=20 2.27.0