diff options
| author | Jordy Zomer <[email protected]> | 2023-06-17 12:38:28 +0100 |
|---|---|---|
| committer | Jens Axboe <[email protected]> | 2023-06-22 07:48:08 -0600 |
| commit | 8270cb10c0681d52fce508f827dfa1688d3acc3a (patch) | |
| tree | a46a3a289f8d0cee96cde9de7aeb44aa8178d264 | |
| parent | 017fb83ee0612595ec70c65ddd83472706b02a50 (diff) | |
cdrom: Fix spectre-v1 gadget
This patch fixes a spectre-v1 gadget in cdrom.
The gadget could be triggered by speculatively
bypassing the cdi->capacity check.
Signed-off-by: Jordy Zomer <[email protected]>
Link: https://lore.kernel.org/all/[email protected]
Reviewed-by: Phillip Potter <[email protected]>
Link: https://lore.kernel.org/all/ZI1+1OG9Ut1MqsUC@equinox
Signed-off-by: Phillip Potter <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jens Axboe <[email protected]>
| -rw-r--r-- | drivers/cdrom/cdrom.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c index bd8cd59c758a..cc2839805983 100644 --- a/drivers/cdrom/cdrom.c +++ b/drivers/cdrom/cdrom.c @@ -264,6 +264,7 @@ #include <linux/errno.h> #include <linux/kernel.h> #include <linux/mm.h> +#include <linux/nospec.h> #include <linux/slab.h> #include <linux/cdrom.h> #include <linux/sysctl.h> @@ -2311,6 +2312,9 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi, if (arg >= cdi->capacity) return -EINVAL; + /* Prevent arg from speculatively bypassing the length check */ + barrier_nospec(); + info = kmalloc(sizeof(*info), GFP_KERNEL); if (!info) return -ENOMEM; |