From nobody Mon Jun 29 21:07:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 30234C433F5 for ; Wed, 2 Feb 2022 19:11:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241291AbiBBTLT (ORCPT ); Wed, 2 Feb 2022 14:11:19 -0500 Received: from mta-10-3.privateemail.com ([198.54.127.62]:38527 "EHLO MTA-10-3.privateemail.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230380AbiBBTLQ (ORCPT ); Wed, 2 Feb 2022 14:11:16 -0500 Received: from mta-10.privateemail.com (localhost [127.0.0.1]) by mta-10.privateemail.com (Postfix) with ESMTP id 4A9FD18000AB; Wed, 2 Feb 2022 14:11:16 -0500 (EST) Received: from localhost.localdomain (unknown [10.20.151.143]) by mta-10.privateemail.com (Postfix) with ESMTPA id AFE8F18000A9; Wed, 2 Feb 2022 14:11:13 -0500 (EST) From: Jordy Zomer To: linux-kernel@vger.kernel.org Cc: Jordy Zomer , Oded Gabbay , Arnd Bergmann , Greg Kroah-Hartman , Ofir Bitton , Dani Liberman , Yuri Nudelman , Sagiv Ozeri , Koby Elbaz , farah kassabri Subject: [PATCHv3] habanalabs: fix potential spectre v1 gadgets Date: Wed, 2 Feb 2022 20:11:00 +0100 Message-Id: <20220202191104.3526448-1-jordy@pwning.systems> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Virus-Scanned: ClamAV using ClamSMTP Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" It appears like nr could be a Spectre v1 gadget as it's supplied by a user and used as an array index. Prevent the contents of kernel memory being leaked to userspace via speculative execution by using array_index_nospec. Signed-off-by: Jordy Zomer --- Changes v1 -> v2: Added the correct offsets Changes v2 -> v3: Fixed line-wrapping --- drivers/misc/habanalabs/common/habanalabs_ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/misc/habanalabs/common/habanalabs_ioctl.c b/drivers/mi= sc/habanalabs/common/habanalabs_ioctl.c index 3ba3a8ffda3e..c1cdf712a10d 100644 --- a/drivers/misc/habanalabs/common/habanalabs_ioctl.c +++ b/drivers/misc/habanalabs/common/habanalabs_ioctl.c @@ -14,6 +14,7 @@ #include #include #include +#include =20 static u32 hl_debug_struct_size[HL_DEBUG_OP_TIMESTAMP + 1] =3D { [HL_DEBUG_OP_ETR] =3D sizeof(struct hl_debug_params_etr), @@ -849,6 +850,7 @@ long hl_ioctl(struct file *filep, unsigned int cmd, uns= igned long arg) } =20 if ((nr >=3D HL_COMMAND_START) && (nr < HL_COMMAND_END)) { + nr =3D array_index_nospec(nr, HL_COMMAND_END); ioctl =3D &hl_ioctls[nr]; } else { dev_err(hdev->dev, "invalid ioctl: pid=3D%d, nr=3D0x%02x\n", @@ -872,6 +874,7 @@ long hl_ioctl_control(struct file *filep, unsigned int = cmd, unsigned long arg) } =20 if (nr =3D=3D _IOC_NR(HL_IOCTL_INFO)) { + nr =3D array_index_nospec(nr, _IOC_NR(HL_IOCTL_INFO)+1); ioctl =3D &hl_ioctls_control[nr]; } else { dev_err(hdev->dev_ctrl, "invalid ioctl: pid=3D%d, nr=3D0x%02x\n", --=20 2.27.0