releases/5.0.6/alsa-seq-oss-fix-spectre-v1-vulnerability.patch

   1 From c709f14f0616482b67f9fbcb965e1493a03ff30b Mon Sep 17 00:00:00 2001
   2 From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
   3 Date: Wed, 20 Mar 2019 18:42:01 -0500
   4 Subject: ALSA: seq: oss: Fix Spectre v1 vulnerability
   5
   6 From: Gustavo A. R. Silva <gustavo@embeddedor.com>
   7
   8 commit c709f14f0616482b67f9fbcb965e1493a03ff30b upstream.
   9
  10 dev is indirectly controlled by user-space, hence leading to
  11 a potential exploitation of the Spectre variant 1 vulnerability.
  12
  13 This issue was detected with the help of Smatch:
  14
  15 sound/core/seq/oss/seq_oss_synth.c:626 snd_seq_oss_synth_make_info() warn: potential spectre issue 'dp->synths' [w] (local cap)
  16
  17 Fix this by sanitizing dev before using it to index dp->synths.
  18
  19 Notice that given that speculation windows are large, the policy is
  20 to kill the speculation on the first load and not worry if it can be
  21 completed with a dependent load/store [1].
  22
  23 [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/
  24
  25 Cc: stable@vger.kernel.org
  26 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
  27 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  28 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  29
  30 ---
  31  sound/core/seq/oss/seq_oss_synth.c |    7 ++++---
  32  1 file changed, 4 insertions(+), 3 deletions(-)
  33
  34 --- a/sound/core/seq/oss/seq_oss_synth.c
  35 +++ b/sound/core/seq/oss/seq_oss_synth.c
  36 @@ -617,13 +617,14 @@ int
  37  snd_seq_oss_synth_make_info(struct seq_oss_devinfo *dp, int dev, struct synth_info *inf)
  38  {
  39         struct seq_oss_synth *rec;
  40 +       struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
  41
  42 -       if (dev < 0 || dev >= dp->max_synthdev)
  43 +       if (!info)
  44                 return -ENXIO;
  45
  46 -       if (dp->synths[dev].is_midi) {
  47 +       if (info->is_midi) {
  48                 struct midi_info minf;
  49 -               snd_seq_oss_midi_make_info(dp, dp->synths[dev].midi_mapped, &minf);
  50 +               snd_seq_oss_midi_make_info(dp, info->midi_mapped, &minf);
  51                 inf->synth_type = SYNTH_TYPE_MIDI;
  52                 inf->synth_subtype = 0;
  53                 inf->nr_voices = 16;