Commit 26ab2eb8 authored Oct 30, 2018 by Jason Wang Committed by Greg Kroah-Hartman Nov 04, 2018

vhost: Fix Spectre V1 vulnerability



[ Upstream commit ff002269a4ee9c769dbf9365acef633ebcbd6cbe ]

The idx in vhost_vring_ioctl() was controlled by userspace, hence a
potential exploitation of the Spectre variant 1 vulnerability.

Fixing this by sanitizing idx before using it to index d->vqs.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 2799b518

drivers/vhost/vhost.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -30,6 +30,7 @@
		#include <linux/sched/mm.h>
		#include <linux/sched/signal.h>
		#include <linux/interval_tree_generic.h>
		#include <linux/nospec.h>

		#include "vhost.h"

		@@ -1397,6 +1398,7 @@ long vhost_vring_ioctl(struct vhost_dev d, unsigned int ioctl, void __user arg
		if (idx >= d->nvqs)
		return -ENOBUFS;

		idx = array_index_nospec(idx, d->nvqs);
		vq = d->vqs[idx];

		mutex_lock(&vq->mutex);