releases/4.14.110/alsa-rawmidi-fix-potential-spectre-v1-vulnerability.patch

   1 From 2b1d9c8f87235f593826b9cf46ec10247741fff9 Mon Sep 17 00:00:00 2001
   2 From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
   3 Date: Wed, 20 Mar 2019 16:15:24 -0500
   4 Subject: ALSA: rawmidi: Fix potential Spectre v1 vulnerability
   5
   6 From: Gustavo A. R. Silva <gustavo@embeddedor.com>
   7
   8 commit 2b1d9c8f87235f593826b9cf46ec10247741fff9 upstream.
   9
  10 info->stream is indirectly controlled by user-space, hence leading to
  11 a potential exploitation of the Spectre variant 1 vulnerability.
  12
  13 This issue was detected with the help of Smatch:
  14
  15 sound/core/rawmidi.c:604 __snd_rawmidi_info_select() warn: potential spectre issue 'rmidi->streams' [r] (local cap)
  16
  17 Fix this by sanitizing info->stream before using it to index
  18 rmidi->streams.
  19
  20 Notice that given that speculation windows are large, the policy is
  21 to kill the speculation on the first load and not worry if it can be
  22 completed with a dependent load/store [1].
  23
  24 [1] https://lore.kernel.org/lkml/20180423164740.GY17484@dhcp22.suse.cz/
  25
  26 Cc: stable@vger.kernel.org
  27 Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
  28 Signed-off-by: Takashi Iwai <tiwai@suse.de>
  29 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  30
  31 ---
  32  sound/core/rawmidi.c |    2 ++
  33  1 file changed, 2 insertions(+)
  34
  35 --- a/sound/core/rawmidi.c
  36 +++ b/sound/core/rawmidi.c
  37 @@ -29,6 +29,7 @@
  38  #include <linux/mutex.h>
  39  #include <linux/module.h>
  40  #include <linux/delay.h>
  41 +#include <linux/nospec.h>
  42  #include <sound/rawmidi.h>
  43  #include <sound/info.h>
  44  #include <sound/control.h>
  45 @@ -591,6 +592,7 @@ static int __snd_rawmidi_info_select(str
  46                 return -ENXIO;
  47         if (info->stream < 0 || info->stream > 1)
  48                 return -EINVAL;
  49 +       info->stream = array_index_nospec(info->stream, 2);
  50         pstr = &rmidi->streams[info->stream];
  51         if (pstr->substream_count == 0)
  52                 return -ENOENT;