riscv: Sanitize syscall table indexing under speculation

Browse source

[ Upstream commit 25fd7ee7bf ]

The syscall number is a user-controlled value used to index into the
syscall table. Use array_index_nospec() to clamp this value after the
bounds check to prevent speculative out-of-bounds access and subsequent
data leakage via cache side channels.

Signed-off-by: Lukas Gerlach <lukas.gerlach@cispa.de>
Link: https://patch.msgid.link/20251218191332.35849-3-lukas.gerlach@cispa.de
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

...

This commit is contained in:

Lukas Gerlach 2025-12-18 20:13:32 +01:00 • committed by Greg Kroah-Hartman

parent f3ee173285

commit c45848936e

1 changed files with 3 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

4

arch/riscv/kernel/traps.c

View file