vhost: Fix Spectre V1 vulnerability
[ Upstream commit ff002269a4ee9c769dbf9365acef633ebcbd6cbe ] The idx in vhost_vring_ioctl() was controlled by userspace, hence a potential exploitation of the Spectre variant 1 vulnerability. Fixing this by sanitizing idx before using it to index d->vqs. Cc: Michael S. Tsirkin <mst@redhat.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Andrea Arcangeli <aarcange@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
8de8589c09
commit
628a149b00
1 changed files with 2 additions and 0 deletions
|
@ -27,6 +27,7 @@
|
|||
#include <linux/cgroup.h>
|
||||
#include <linux/module.h>
|
||||
#include <linux/sort.h>
|
||||
#include <linux/nospec.h>
|
||||
|
||||
#include "vhost.h"
|
||||
|
||||
|
@ -748,6 +749,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
|
|||
if (idx >= d->nvqs)
|
||||
return -ENOBUFS;
|
||||
|
||||
idx = array_index_nospec(idx, d->nvqs);
|
||||
vq = d->vqs[idx];
|
||||
|
||||
mutex_lock(&vq->mutex);
|
||||
|
|
Loading…
Add table
Reference in a new issue