mirror of
https://github.com/torvalds/linux.git
synced 2024-12-28 22:02:28 +00:00
a7102c7461
channel and addr->channel are indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. These issues were detected with the help of Smatch: drivers/char/ipmi/ipmi_msghandler.c:1381 ipmi_set_my_address() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1401 ipmi_get_my_address() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1421 ipmi_set_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1441 ipmi_get_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:2260 check_addr() warn: potential spectre issue 'intf->addrinfo' [r] (local cap) Fix this by sanitizing channel and addr->channel before using them to index user->intf->addrinfo and intf->addrinfo, correspondingly. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Cc: stable@vger.kernel.org Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> |
||
|---|---|---|
| .. | ||
| bt-bmc.c | ||
| ipmi_bt_sm.c | ||
| ipmi_devintf.c | ||
| ipmi_dmi.c | ||
| ipmi_dmi.h | ||
| ipmi_kcs_sm.c | ||
| ipmi_msghandler.c | ||
| ipmi_powernv.c | ||
| ipmi_poweroff.c | ||
| ipmi_si_hardcode.c | ||
| ipmi_si_hotmod.c | ||
| ipmi_si_intf.c | ||
| ipmi_si_mem_io.c | ||
| ipmi_si_parisc.c | ||
| ipmi_si_pci.c | ||
| ipmi_si_platform.c | ||
| ipmi_si_port_io.c | ||
| ipmi_si_sm.h | ||
| ipmi_si.h | ||
| ipmi_smic_sm.c | ||
| ipmi_ssif.c | ||
| ipmi_watchdog.c | ||
| Kconfig | ||
| kcs_bmc_aspeed.c | ||
| kcs_bmc_npcm7xx.c | ||
| kcs_bmc.c | ||
| kcs_bmc.h | ||
| Makefile | ||