4.19-stable patches

added patches:
	gpio-prevent-potential-speculation-leaks-in-gpio_device_get_desc.patch

diff --git a/queue-4.19/gpio-prevent-potential-speculation-leaks-in-gpio_device_get_desc.patch b/queue-4.19/gpio-prevent-potential-speculation-leaks-in-gpio_device_get_desc.patch
new file mode 100644 (file)
index 0000000..896c45d
--- /dev/null
+++ b/queue-4.19/gpio-prevent-potential-speculation-leaks-in-gpio_device_get_desc.patch
@@ -0,0 +1,50 @@
+From d795848ecce24a75dfd46481aee066ae6fe39775 Mon Sep 17 00:00:00 2001
+From: Hagar Hemdan <hagarhem@amazon.com>
+Date: Thu, 23 May 2024 08:53:32 +0000
+Subject: gpio: prevent potential speculation leaks in gpio_device_get_desc()
+
+From: Hagar Hemdan <hagarhem@amazon.com>
+
+commit d795848ecce24a75dfd46481aee066ae6fe39775 upstream.
+
+Userspace may trigger a speculative read of an address outside the gpio
+descriptor array.
+Users can do that by calling gpio_ioctl() with an offset out of range.
+Offset is copied from user and then used as an array index to get
+the gpio descriptor without sanitization in gpio_device_get_desc().
+
+This change ensures that the offset is sanitized by using
+array_index_nospec() to mitigate any possibility of speculative
+information leaks.
+
+This bug was discovered and resolved using Coverity Static Analysis
+Security Testing (SAST) by Synopsys, Inc.
+
+Signed-off-by: Hagar Hemdan <hagarhem@amazon.com>
+Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com
+Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
+Signed-off-by: Hugo SIMELIERE <hsimeliere.opensource@witekio.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/gpio/gpiolib.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/gpio/gpiolib.c
++++ b/drivers/gpio/gpiolib.c
+@@ -3,6 +3,7 @@
+ #include <linux/module.h>
+ #include <linux/interrupt.h>
+ #include <linux/irq.h>
++#include <linux/nospec.h>
+ #include <linux/spinlock.h>
+ #include <linux/list.h>
+ #include <linux/device.h>
+@@ -144,7 +145,7 @@ struct gpio_desc *gpiochip_get_desc(stru
+       if (hwnum >= gdev->ngpio)
+               return ERR_PTR(-EINVAL);
+ 
+-      return &gdev->descs[hwnum];
++      return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)];
+ }
+ 
+ /**

diff --git a/queue-4.19/series b/queue-4.19/series
index 45f0c37534d155bcced779e8925960a9cc516d90..eae9ae1a5ef54b53329a89193236e85b069baa37 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -23,3 +23,4 @@ spi-bcm63xx-enable-module-autoloading.patch
 x86-hyperv-set-x86_feature_tsc_known_freq-when-hyper.patch
 ocfs2-add-bounds-checking-to-ocfs2_xattr_find_entry.patch
 ocfs2-strict-bound-check-before-memcmp-in-ocfs2_xatt.patch
+gpio-prevent-potential-speculation-leaks-in-gpio_device_get_desc.patch