Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Gustavo A. R. Silva 6b6f0a9095 ipmi: msghandler: Fix potential Spectre v1 vulnerabilities ... commit a7102c7461 upstream. channel and addr->channel are indirectly controlled by user-space, hence leading to a potential exploitation of the Spectre variant 1 vulnerability. These issues were detected with the help of Smatch: drivers/char/ipmi/ipmi_msghandler.c:1381 ipmi_set_my_address() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1401 ipmi_get_my_address() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1421 ipmi_set_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [w] (local cap) drivers/char/ipmi/ipmi_msghandler.c:1441 ipmi_get_my_LUN() warn: potential spectre issue 'user->intf->addrinfo' [r] (local cap) drivers/char/ipmi/ipmi_msghandler.c:2260 check_addr() warn: potential spectre issue 'intf->addrinfo' [r] (local cap) Fix this by sanitizing channel and addr->channel before using them to index user->intf->addrinfo and intf->addrinfo, correspondingly. Notice that given that speculation windows are large, the policy is to kill the speculation on the first load and not worry if it can be completed with a dependent load/store [1]. [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/ Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Corey Minyard <cminyard@mvista.com> [bwh: Backported to 3.16: adjust context] Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		History 2019-05-02 21:41:27 +01:00
..
ipmi_bt_sm.c	ipmi: Move BT capabilities detection to the detect call	2018-12-16 22:08:57 +00:00
ipmi_devintf.c	ipmi: info leak in compat_ipmi_ioctl()	2013-09-05 08:34:31 -07:00
ipmi_kcs_sm.c	ipmi: Reset the KCS timeout when starting error recovery	2014-04-17 12:23:06 -07:00
ipmi_msghandler.c	ipmi: msghandler: Fix potential Spectre v1 vulnerabilities	2019-05-02 21:41:27 +01:00
ipmi_poweroff.c	char: Convert use of typedef ctl_table to struct ctl_table	2013-06-17 16:43:08 -07:00
ipmi_si_intf.c	ipmi: move timer init to before irq is setup	2016-01-18 22:27:25 +00:00
ipmi_si_sm.h	IPMI: Style fixes in the system interface code	2008-04-29 08:06:15 -07:00
ipmi_smic_sm.c	ipmi: use USEC_PER_SEC instead of 1000000 for more meaningful	2014-01-25 15:31:58 -08:00
ipmi_watchdog.c	char/ipmi: remove local ioctl defines replaced by generic ones	2012-07-23 12:48:04 +02:00
Kconfig	ipmi: Turn off default probing of interfaces	2014-04-17 12:23:07 -07:00
Makefile	drivers/char/ipmi/Makefile: replace the use of <module>-objs with <module>-y	2010-10-27 18:03:14 -07:00