github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

platform/x86/amd/hsmp: Clamp ioctl/send_message indices (Spectre v1)

Browse Source 
Although validate_message() checks msg_id, a mispredicted branch can
still allow speculative indexing into hsmp_msg_desc_table[]. Clamp
msg.msg_id with array_index_nospec() at entry to hsmp_ioctl_msg() so
downstream dereferences (including via is_get_msg() and
hsmp_send_message()) see a bounded index.

Similarly, hsmp_send_message() bounds-checks msg->sock_ind before
indexing hsmp_pdev.sock[], but a mispredicted branch can still
speculatively use the raw index (Spectre v1, CVE-2017-5753). Apply
array_index_nospec() after the check so every caller that reaches
hsmp_pdev.sock[] through this helper sees a clamped socket
index—including hsmp_ioctl_msg() and any other path that hands a
user-derived struct hsmp_message to hsmp_send_message().

Reviewed-by: Muthusamy Ramalingam <muthusamy.ramalingam@amd.com>
Signed-off-by: Muralidhara M K <muralidhara.mk@amd.com>
Link: https://patch.msgid.link/20260612042610.1629037-7-muralidhara.mk@amd.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
This commit is contained in:
Muralidhara M K 2026-06-12 09:56:08 +05:30 committed by Ilpo Järvinen
parent 037f0b03c6
commit d20457b46e
No known key found for this signature in database
GPG Key ID: 59AC4F6153E5CE31
1 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
drivers/platform/x86/amd/hsmp/hsmp.c
View File

@ -202,6 +202,7 @@ static int validate_message(struct hsmp_message *msg)
int hsmp_send_message(struct hsmp_message *msg)
{
struct hsmp_socket *sock;
unsigned int sock_ind;
int ret;
if (!msg)
@ -212,7 +213,15 @@ int hsmp_send_message(struct hsmp_message *msg)
if (!hsmp_pdev.sock || msg->sock_ind >= hsmp_pdev.num_sockets)
return -ENODEV;
sock = &hsmp_pdev.sock[msg->sock_ind];
/*
* Sanitize sock_ind after the bounds check. A mispredicted branch can
* still let the CPU speculatively use msg->sock_ind as an index into
* hsmp_pdev.sock[] (Spectre v1, CVE-2017-5753), including for callers
* other than hsmp_ioctl_msg() that pass a user-derived socket index.
*/
sock_ind = array_index_nospec(msg->sock_ind, hsmp_pdev.num_sockets);
sock = &hsmp_pdev.sock[sock_ind];
ret = down_interruptible(&sock->hsmp_sem);
if (ret < 0)
@ -308,6 +317,19 @@ long hsmp_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
if (msg.msg_id < HSMP_TEST || msg.msg_id >= HSMP_MSG_ID_MAX)
return -ENOMSG;
/*
* Sanitize the user-controlled msg_id against speculative
* execution. The bounds check above retires the out-of-range
* case with -ENOMSG, but a mispredicted branch can still let the
* CPU speculatively use msg_id as an index into
* hsmp_msg_desc_table[] (here and in validate_message() /
* is_get_msg() called downstream via hsmp_send_message()), and
* pull arbitrary kernel memory into the cache (Spectre v1,
* CVE-2017-5753). Clamp once into msg.msg_id so every downstream
* dereference sees the sanitized value.
*/
msg.msg_id = array_index_nospec(msg.msg_id, HSMP_MSG_ID_MAX);
switch (fp->f_mode & (FMODE_WRITE | FMODE_READ)) {
case FMODE_WRITE:
/*