kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/drivers/tty/vt
History
Gustavo A. R. Silva 458697ab18 tty: vt_ioctl: fix potential Spectre v1 
commit e97267cb4d upstream.

vsa.console is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/tty/vt/vt_ioctl.c:711 vt_ioctl() warn: potential spectre issue
'vc_cons' [r]

Fix this by sanitizing vsa.console before using it to index vc_cons

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Reviewed-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-12-16 22:09:20 +00:00
..
.gitignore TTY: move .gitignore from drivers/char/ to drivers/tty/vt/ 2010-11-05 22:18:23 -07:00
consolemap.c tty/vt: don't set font mappings on vc not supporting this 2014-11-14 15:20:00 +00:00
cp437.uni TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
defkeymap.c_shipped TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
defkeymap.map TTY: create drivers/tty/vt and move the vt code there 2010-11-05 08:16:52 -07:00
keyboard.c tty/vt/keyboard: fix OOB access in do_compute_shiftstate() 2016-11-20 01:16:56 +00:00
Makefile tty: vt/Makefile: set the variables to static 2013-01-15 21:52:24 -08:00
selection.c tty: Fix unsafe vt paste_selection() 2013-07-23 16:47:10 -07:00
vc_screen.c vc: switch to fixed_size_llseek() 2013-06-29 12:57:30 +04:00
vt.c vt: prevent leaking uninitialized data to userspace via /dev/vcs* 2018-11-20 18:05:31 +00:00
vt_ioctl.c tty: vt_ioctl: fix potential Spectre v1 2018-12-16 22:09:20 +00:00