s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

'level' is user space controlled and used to read from an array. Add the
missing array_index_nospec() call to prevent speculative execution.

Cc: stable@vger.kernel.org
Fixes: 0d30871739ab ("s390/diag: Add memory topology information via diag310")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Mete Durlu <meted@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

diff --git a/arch/s390/kernel/diag/diag310.c b/arch/s390/kernel/diag/diag310.c
index f411562aa7f6b9fb1abde27db6ee0303dd7af93b..c68ec9d28513dbb5410430bfcd7998478388208f 100644 (file)
--- a/arch/s390/kernel/diag/diag310.c
+++ b/arch/s390/kernel/diag/diag310.c
@@ -190,17 +190,18 @@ static int memtop_get_stride_len(unsigned long *res)
 static int memtop_get_page_count(unsigned long *res, unsigned long level)
 {
        static unsigned long memtop_pages[DIAG310_LEVELMAX];
-       unsigned long pages;
+       unsigned long pages, idx;
        int rc;
 
        if (level > DIAG310_LEVELMAX || level < DIAG310_LEVELMIN)
                return -EINVAL;
-       pages = READ_ONCE(memtop_pages[level - 1]);
+       idx = array_index_nospec(level - 1, ARRAY_SIZE(memtop_pages));
+       pages = READ_ONCE(memtop_pages[idx]);
        if (!pages) {
                rc = diag310_get_memtop_size(&pages, level);
                if (rc)
                        return rc;
-               WRITE_ONCE(memtop_pages[level - 1], pages);
+               WRITE_ONCE(memtop_pages[idx], pages);
        }
        *res = pages;
        return 0;