]> git.baikalelectronics.ru Git - kernel.git/commit
ALSA: control: Hardening for potential Spectre v1
authorTakashi Iwai <tiwai@suse.de>
Tue, 24 Apr 2018 05:45:56 +0000 (07:45 +0200)
committerTakashi Iwai <tiwai@suse.de>
Wed, 25 Apr 2018 08:37:46 +0000 (10:37 +0200)
commit088e861edffb84879cf0c0d1b02eda078c3a0ffe
tree90999b564bf855bf817623802810b90a47831f5c
parent8d218dd8116695ecda7164f97631c069938aa22e
ALSA: control: Hardening for potential Spectre v1

As recently Smatch suggested, a few places in ALSA control core codes
may expand the array directly from the user-space value with
speculation:

  sound/core/control.c:1003 snd_ctl_elem_lock() warn: potential spectre issue 'kctl->vd'
  sound/core/control.c:1031 snd_ctl_elem_unlock() warn: potential spectre issue 'kctl->vd'
  sound/core/control.c:844 snd_ctl_elem_info() warn: potential spectre issue 'kctl->vd'
  sound/core/control.c:891 snd_ctl_elem_read() warn: potential spectre issue 'kctl->vd'
  sound/core/control.c:939 snd_ctl_elem_write() warn: potential spectre issue 'kctl->vd'

Although all these seem doing only the first load without further
reference, we may want to stay in a safer side, so hardening with
array_index_nospec() would still make sense.

In this patch, we put array_index_nospec() to the common
snd_ctl_get_ioff*() helpers instead of each caller.  These helpers are
also referred from some drivers, too, and basically all usages are to
calculate the array index from the user-space value, hence it's better
to cover there.

BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
include/sound/control.h