Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 84b510e2 authored by Chris Wilson's avatar Chris Wilson
Browse files

drm/i915/query: Protect tainted function pointer lookup 



Smatch identifies i915_query_ioctl() as being a potential victim of
Spectre due to its use of a tainted user index into a function pointer
array. Use array_index_nospec() to defang the user index before using it
to lookup the function pointer.

Fixes: a446ae2c ("drm/i915: add query uAPI")
Signed-off-by: default avatarChris Wilson <chris@chris-wilson.co.uk>
Cc: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
Cc: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
Cc: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Reviewed-by: default avatarLionel Landwerlin <lionel.g.landwerlin@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20180521210530.26008-1-chris@chris-wilson.co.uk
parent d93fa1b4

drivers/gpu/drm/i915/i915_query.c

+7 −3
Original line number Diff line number Diff line
@@ -4,6 +4,8 @@ 
 * Copyright © 2018 Intel Corporation

 */



#include <linux/nospec.h>



#include "i915_drv.h"

#include "i915_query.h"

#include <uapi/drm/i915_drm.h>
@@ -111,10 +113,12 @@ int i915_query_ioctl(struct drm_device *dev, void *data, struct drm_file *file) 


		func_idx = item.query_id - 1;



		if (func_idx < ARRAY_SIZE(i915_query_funcs))

			ret = i915_query_funcs[func_idx](dev_priv, &item);

		else

		ret = -EINVAL;

		if (func_idx < ARRAY_SIZE(i915_query_funcs)) {

			func_idx = array_index_nospec(func_idx,

						      ARRAY_SIZE(i915_query_funcs));

			ret = i915_query_funcs[func_idx](dev_priv, &item);

		}



		/* Only write the length back to userspace if they differ. */

		if (ret != item.length && put_user(ret, &user_item_ptr->length))