On Wed, 12 Dec 2018 18:20:49 +0100, Gustavo A. R. Silva wrote: > > info.mode and info.port are indirectly controlled by user-space, > hence leading to a potential exploitation of the Spectre variant 1 > vulnerability. > > These issues were detected with the help of Smatch: > > sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential > spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap) > sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential > spectre issue 'emu->portptrs' [w] (local cap) > sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential > spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap) > > Fix this by sanitizing both info.mode and info.port before using them > to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and > emu->portptrs. > > Notice that given that speculation windows are large, the policy is > to kill the speculation on the first load and not worry if it can be > completed with a dependent load/store [1]. > > [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 > > Cc: [email protected] > Signed-off-by: Gustavo A. R. Silva <[email protected]>
Applied now (with moving the linux/nospec.h in a more appropriate line). thanks, Takashi
