releases/4.4.170/alsa-pcm-fix-potential-spectre-v1-vulnerability.patch

   1 From 94ffb030b6d31ec840bb811be455dd2e26a4f43e Mon Sep 17 00:00:00 2001
   2 From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
   3 Date: Wed, 12 Dec 2018 15:36:28 -0600
   4 Subject: ALSA: pcm: Fix potential Spectre v1 vulnerability
   5
   6 From: Gustavo A. R. Silva <gustavo@embeddedor.com>
   7
   8 commit 94ffb030b6d31ec840bb811be455dd2e26a4f43e upstream.
   9
  10 stream is indirectly controlled by user-space, hence leading to
  11 a potential exploitation of the Spectre variant 1 vulnerability.
  12
  13 This issue was detected with the help of Smatch:
  14
  15 sound/core/pcm.c:140 snd_pcm_control_ioctl() warn: potential spectre issue 'pcm->streams' [r] (local cap)
  16
  17 Fix this by sanitizing stream before using it to index pcm->streams
  18
  19 Notice that given that speculation windows are large, the policy is
  20 to kill the speculation on the first load and not worry if it can be
  21 completed with a dependent load/store [1].
  22
  23 [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2
  24
  25 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
  26 Cc: stable@vger.kernel.org
  27 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  28 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  29
  30 ---
  31  sound/core/pcm.c |    2 ++
  32  1 file changed, 2 insertions(+)
  33
  34 --- a/sound/core/pcm.c
  35 +++ b/sound/core/pcm.c
  36 @@ -25,6 +25,7 @@
  37  #include <linux/time.h>
  38  #include <linux/mutex.h>
  39  #include <linux/device.h>
  40 +#include <linux/nospec.h>
  41  #include <sound/core.h>
  42  #include <sound/minors.h>
  43  #include <sound/pcm.h>
  44 @@ -125,6 +126,7 @@ static int snd_pcm_control_ioctl(struct
  45                                 return -EFAULT;
  46                         if (stream < 0 || stream > 1)
  47                                 return -EINVAL;
  48 +                       stream = array_index_nospec(stream, 2);
  49                         if (get_user(subdevice, &info->subdevice))
  50                                 return -EFAULT;
  51                         mutex_lock(&register_mutex);