cdrom: Fix spectre-v1 gadget
This patch fixes a spectre-v1 gadget in cdrom. The gadget could be triggered by speculatively bypassing the cdi->capacity check. Signed-off-by: Jordy Zomer <jordyzomer@google.com> Link: https://lore.kernel.org/all/20230612110040.849318-2-jordyzomer@google.com Reviewed-by: Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/all/ZI1+1OG9Ut1MqsUC@equinox Signed-off-by: Phillip Potter <phil@philpotter.co.uk> Link: https://lore.kernel.org/r/20230617113828.1230-2-phil@philpotter.co.uk Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Родитель
017fb83ee0
Коммит
8270cb10c0
|
@ -264,6 +264,7 @@
|
|||
#include <linux/errno.h>
|
||||
#include <linux/kernel.h>
|
||||
#include <linux/mm.h>
|
||||
#include <linux/nospec.h>
|
||||
#include <linux/slab.h>
|
||||
#include <linux/cdrom.h>
|
||||
#include <linux/sysctl.h>
|
||||
|
@ -2311,6 +2312,9 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
|
|||
if (arg >= cdi->capacity)
|
||||
return -EINVAL;
|
||||
|
||||
/* Prevent arg from speculatively bypassing the length check */
|
||||
barrier_nospec();
|
||||
|
||||
info = kmalloc(sizeof(*info), GFP_KERNEL);
|
||||
if (!info)
|
||||
return -ENOMEM;
|
||||
|
|
Загрузка…
Ссылка в новой задаче