]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
aio: fix spectre gadget in lookup_ioctx
authorJeff Moyer <jmoyer@redhat.com>
Tue, 11 Dec 2018 17:37:49 +0000 (12:37 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 21 Dec 2018 13:11:31 +0000 (14:11 +0100)
commit3a7bac902691cd92cb69f95d98dc675dea8b3228
treef925cb1904d7e41cfebe05dd0f04bbe11732ab0e
parent4cf3b84a10eae6d6d9b6bd369b6906ae7532abd1
aio: fix spectre gadget in lookup_ioctx

commit a538e3ff9dabcdf6c3f477a373c629213d1c3066 upstream.

Matthew pointed out that the ioctx_table is susceptible to spectre v1,
because the index can be controlled by an attacker.  The below patch
should mitigate the attack for all of the aio system calls.

Cc: stable@vger.kernel.org
Reported-by: Matthew Wilcox <willy@infradead.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/aio.c