vmci: prevent speculation leaks by sanitizing event in event_deliver()

commit 8003f00d895310d409b2bf9ef907c56b42a4e0f4 upstream.

Coverity spotted that event_msg is controlled by user-space,
event_msg->event_data.event is passed to event_deliver() and used
as an index without sanitization.

This change ensures that the event index is sanitized to mitigate any
possibility of speculative information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Only compile tested, no access to HW.

Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Cc: stable <stable@kernel.org>
Signed-off-by: Hagar Gamal Halim Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com
Link: https://lore.kernel.org/r/20240430085916.4753-1-hagarhem@amazon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c
index e3436abf39f4585f3a2599fbb620f6e7d3dc73d9..5b7ef47f4c11866c2e7096062709e37adcc9fea6 100644 (file)
--- a/drivers/misc/vmw_vmci/vmci_event.c
+++ b/drivers/misc/vmw_vmci/vmci_event.c
@@ -9,6 +9,7 @@
 #include <linux/vmw_vmci_api.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/rculist.h>
@@ -86,9 +87,12 @@ static void event_deliver(struct vmci_event_msg *event_msg)
 {
        struct vmci_subscription *cur;
        struct list_head *subscriber_list;
+       u32 sanitized_event, max_vmci_event;
 
        rcu_read_lock();
-       subscriber_list = &subscriber_array[event_msg->event_data.event];
+       max_vmci_event = ARRAY_SIZE(subscriber_array);
+       sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event);
+       subscriber_list = &subscriber_array[sanitized_event];
        list_for_each_entry_rcu(cur, subscriber_list, node) {
                cur->callback(cur->id, &event_msg->event_data,
                              cur->callback_data);