[PATCH 4.4 34/70] misc: hmc6352: fix potential Spectre v1
From: Greg Kroah-Hartman
Date: Mon Sep 24 2018 - 08:58:49 EST
4.4-stable review patch. If anyone has any objections, please let me know.
From: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx>
commit de916736aaaadddbd6061472969f667b14204aa9 upstream.
val is indirectly controlled by user-space, hence leading to a
potential exploitation of the Spectre variant 1 vulnerability.
This issue was detected with the help of Smatch:
drivers/misc/hmc6352.c:54 compass_store() warn: potential spectre issue
Fix this by sanitizing val before using it to index map
Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store .
Signed-off-by: Gustavo A. R. Silva <gustavo@xxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
drivers/misc/hmc6352.c | 2 ++
1 file changed, 2 insertions(+)
@@ -27,6 +27,7 @@
@@ -50,6 +51,7 @@ static int compass_store(struct device *
if (val >= strlen(map))
+ val = array_index_nospec(val, strlen(map));
ret = compass_command(c, map[val]);