kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/sound/synth/emux
History
Gustavo A. R. Silva 913fc5d772 ALSA: emux: Fix potential Spectre v1 vulnerabilities 
commit 4aea96f423 upstream.

info.mode and info.port are indirectly controlled by user-space,
hence leading to a potential exploitation of the Spectre variant 1
vulnerability.

These issues were detected with the help of Smatch:

sound/synth/emux/emux_hwdep.c:72 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[i]->ctrls' [w] (local cap)
sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs' [w] (local cap)
sound/synth/emux/emux_hwdep.c:75 snd_emux_hwdep_misc_mode() warn: potential spectre issue 'emu->portptrs[info.port]->ctrls' [w] (local cap)

Fix this by sanitizing both info.mode and info.port before using them
to index emu->portptrs[i]->ctrls, emu->portptrs[info.port]->ctrls and
emu->portptrs.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-04-04 16:13:49 +01:00
..
emux.c sound: Add module.h to the previously silent sound users 2011-10-31 19:31:21 -04:00
emux_effect.c [ALSA] Remove xxx_t typedefs: Emu-X synth 2006-01-03 12:18:14 +01:00
emux_hwdep.c ALSA: emux: Fix potential Spectre v1 vulnerabilities 2019-04-04 16:13:49 +01:00
emux_nrpn.c ALSA: Kill snd_assert() in other places 2008-08-13 11:46:40 +02:00
emux_oss.c ALSA: synth: Fix conflicting OSS device registration on AWE32 2015-10-30 13:59:29 +00:00
emux_proc.c include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h 2010-03-30 22:02:32 +09:00
emux_seq.c ALSA: emux: Fix mutex deadlock in OSS emulation 2015-05-12 09:36:38 +01:00
emux_synth.c sound: Add export.h for THIS_MODULE/EXPORT_SYMBOL where needed 2011-10-31 19:31:22 -04:00
emux_voice.h [ALSA] Remove sound/driver.h 2008-01-31 17:29:48 +01:00
Makefile ALSA: clean up the logic for building sequencer modules 2009-05-29 11:49:42 +02:00
soundfont.c ALSA: synth: emux: soundfont.c: Cleaning up memory leak 2014-06-01 14:33:09 +02:00