Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f31eb729 authored by Gustavo A. R. Silva's avatar Gustavo A. R. Silva Committed by Greg Kroah-Hartman
Browse files

usbip: vhci_sysfs: fix potential Spectre v1 

commit a0d6ec88090d7b1b008429c44532a388e29bb1bd upstream.

pdev_nr and rhport can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:
drivers/usb/usbip/vhci_sysfs.c:238 detach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:328 attach_store() warn: potential spectre issue 'vhcis'
drivers/usb/usbip/vhci_sysfs.c:338 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_ss->vdev'
drivers/usb/usbip/vhci_sysfs.c:340 attach_store() warn: potential spectre issue 'vhci->vhci_hcd_hs->vdev'

Fix this by sanitizing pdev_nr and rhport before using them to index
vhcis and vhci->vhci_hcd_ss->vdev respectively.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2



Cc: stable@vger.kernel.org
Signed-off-by: default avatarGustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: default avatarShuah Khan (Samsung OSG) <shuah@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1caeb502

drivers/usb/usbip/vhci_sysfs.c

+16 −8
Original line number Diff line number Diff line
@@ -24,6 +24,9 @@ 
#include <linux/platform_device.h>

#include <linux/slab.h>



/* Hardening for Spectre-v1 */

#include <linux/nospec.h>



#include "usbip_common.h"

#include "vhci.h"
@@ -219,16 +222,20 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport) 
	return 0;

}



static int valid_port(__u32 pdev_nr, __u32 rhport)

static int valid_port(__u32 *pdev_nr, __u32 *rhport)

{

	if (pdev_nr >= vhci_num_controllers) {

		pr_err("pdev %u\n", pdev_nr);

	if (*pdev_nr >= vhci_num_controllers) {

		pr_err("pdev %u\n", *pdev_nr);

		return 0;

	}

	if (rhport >= VHCI_HC_PORTS) {

		pr_err("rhport %u\n", rhport);

	*pdev_nr = array_index_nospec(*pdev_nr, vhci_num_controllers);



	if (*rhport >= VHCI_HC_PORTS) {

		pr_err("rhport %u\n", *rhport);

		return 0;

	}

	*rhport = array_index_nospec(*rhport, VHCI_HC_PORTS);



	return 1;

}
@@ -246,7 +253,7 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr, 
	pdev_nr = port_to_pdev_nr(port);

	rhport = port_to_rhport(port);



	if (!valid_port(pdev_nr, rhport))

	if (!valid_port(&pdev_nr, &rhport))

		return -EINVAL;



	hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);
@@ -272,7 +279,8 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr, 
}

static DEVICE_ATTR(detach, S_IWUSR, NULL, store_detach);



static int valid_args(__u32 pdev_nr, __u32 rhport, enum usb_device_speed speed)

static int valid_args(__u32 *pdev_nr, __u32 *rhport,

		      enum usb_device_speed speed)

{

	if (!valid_port(pdev_nr, rhport)) {

		return 0;
@@ -336,7 +344,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr, 
			     sockfd, devid, speed);



	/* check received parameters */

	if (!valid_args(pdev_nr, rhport, speed))

	if (!valid_args(&pdev_nr, &rhport, speed))

		return -EINVAL;



	hcd = platform_get_drvdata(vhcis[pdev_nr].pdev);