diff options
| author | Mark Rutland <mark.rutland@arm.com> | 2018-07-10 19:01:22 +0100 |
|---|---|---|
| committer | Jason Liu <jason.hui.liu@nxp.com> | 2018-08-29 16:11:02 +0800 |
| commit | 1d66d459fe127d3d2115fb550b6a55d5e2f13ab4 (patch) | |
| tree | 322e04d0fd73def1e78d53db48809ebf64289513 /arch/arm64/kernel | |
| parent | c557b19b92b13ce1c5a1f263a0ce8e6f9aecbafd (diff) | |
arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
It's possible for userspace to control idx. Sanitize idx when using it
as an array index, to inhibit the potential spectre-v1 write gadget.
Found by smatch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
(cherry picked from commit 14d6e289a89780377f8bb09de8926d3c62d763cd)
[Jason]: fix build break by include the nospec.h
(cherry picked from commit 0340679319c7d64970606a4480998af372beea2c)
Diffstat (limited to 'arch/arm64/kernel')
| -rw-r--r-- | arch/arm64/kernel/ptrace.c | 20 |
1 files changed, 12 insertions, 8 deletions
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 8eedeef375d6..5346c4cc65e6 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -24,6 +24,7 @@ #include <linux/kernel.h> #include <linux/sched.h> #include <linux/mm.h> +#include <linux/nospec.h> #include <linux/smp.h> #include <linux/ptrace.h> #include <linux/user.h> @@ -266,19 +267,22 @@ static int ptrace_hbp_set_event(unsigned int note_type, switch (note_type) { case NT_ARM_HW_BREAK: - if (idx < ARM_MAX_BRP) { - tsk->thread.debug.hbp_break[idx] = bp; - err = 0; - } + if (idx >= ARM_MAX_BRP) + goto out; + idx = array_index_nospec(idx, ARM_MAX_BRP); + tsk->thread.debug.hbp_break[idx] = bp; + err = 0; break; case NT_ARM_HW_WATCH: - if (idx < ARM_MAX_WRP) { - tsk->thread.debug.hbp_watch[idx] = bp; - err = 0; - } + if (idx >= ARM_MAX_WRP) + goto out; + idx = array_index_nospec(idx, ARM_MAX_WRP); + tsk->thread.debug.hbp_watch[idx] = bp; + err = 0; break; } +out: return err; } |