Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Fri,  9 Jun 2023 13:13:55 +0000
In-Reply-To: <20230609131355.71130-1-jordyzomer@google.com>
Mime-Version: 1.0
References: <20230609131355.71130-1-jordyzomer@google.com>
Message-ID: <20230609131355.71130-2-jordyzomer@google.com>
Subject: [PATCH 1/1] cdrom: Fix spectre-v1 gadget
From:   Jordy Zomer <jordyzomer@google.com>
To:     linux-kernel@vger.kernel.org
Cc:     phil@philpotter.co.uk, Jordy Zomer <jordyzomer@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

This patch fixes a spectre-v1 gadget in cdrom.
The gadget could be triggered by,
 speculatviely bypassing the cdi->capacity check.

Signed-off-by: Jordy Zomer <jordyzomer@google.com>
---
 drivers/cdrom/cdrom.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 416f723a2dbb..3c349bc0a269 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -233,6 +233,7 @@
 
 -------------------------------------------------------------------------*/
 
+#include "asm/barrier.h"
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #define REVISION "Revision: 3.20"
@@ -2329,6 +2330,8 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
 	if (arg >= cdi->capacity)
 		return -EINVAL;
 
+	arg = array_index_mask_nospec(arg, cdi->capacity);
+
 	info = kmalloc(sizeof(*info), GFP_KERNEL);
 	if (!info)
 		return -ENOMEM;
-- 
2.41.0.162.gfafddb0af9-goog