Merge "drm/ioctl: Fix Spectre v1 vulnerabilities" (1cb98de5) · Commits · e / devices / android_kernel_fairphone_FP4

drivers/gpu/drm/drm_ioctl.c

+8 −2

Original line number	Diff line number	Diff line
		@@ -37,6 +37,7 @@

		#include <linux/pci.h>
		#include <linux/export.h>
		#include <linux/nospec.h>

		/**
		* DOC: getunique and setversion story
		@@ -794,13 +795,17 @@ long drm_ioctl(struct file *filp,

		if (is_driver_ioctl) {
		/* driver ioctl */
		if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
		unsigned int index = nr - DRM_COMMAND_BASE;

		if (index >= dev->driver->num_ioctls)
		goto err_i1;
		ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
		index = array_index_nospec(index, dev->driver->num_ioctls);
		ioctl = &dev->driver->ioctls[index];
		} else {
		/* core ioctl */
		if (nr >= DRM_CORE_IOCTL_COUNT)
		goto err_i1;
		nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
		ioctl = &drm_ioctls[nr];
		}

		@@ -882,6 +887,7 @@ bool drm_ioctl_flags(unsigned int nr, unsigned int *flags)

		if (nr >= DRM_CORE_IOCTL_COUNT)
		return false;
		nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);

		*flags = drm_ioctls[nr].flags;
		return true;