gitlab.arm.com will be in the maintainance mode on Wednesday June 29th 01:00 - 10:00 (UTC+1). Repositories is read only during the maintainance.

Commit ec67aaa4 authored by Davidlohr Bueso's avatar Davidlohr Bueso Committed by Linus Torvalds
Browse files

sysvipc/sem: mitigate semnum index against spectre v1

Both smatch and coverity are reporting potential issues with spectre
variant 1 with the 'semnum' index within the sma->sems array, ie:

  ipc/sem.c:388 sem_lock() warn: potential spectre issue 'sma->sems'
  ipc/sem.c:641 perform_atomic_semop_slow() warn: potential spectre issue 'sma->sems'
  ipc/sem.c:721 perform_atomic_semop() warn: potential spectre issue 'sma->sems'

Avoid any possible speculation by using array_index_nospec() thus
ensuring the semnum value is bounded to [0, sma->sem_nsems).  With the
exception of sem_lock() all of these are slowpaths.

Link: http://lkml.kernel.org/r/20180423171131.njs4rfm2yzyeg6do@linux-n805

Signed-off-by: default avatarDavidlohr Bueso <dbueso@suse.de>
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc: Manfred Spraul <manfred@colorfullife.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent f1b4bd06
...@@ -85,6 +85,7 @@ ...@@ -85,6 +85,7 @@
#include <linux/nsproxy.h> #include <linux/nsproxy.h>
#include <linux/ipc_namespace.h> #include <linux/ipc_namespace.h>
#include <linux/sched/wake_q.h> #include <linux/sched/wake_q.h>
#include <linux/nospec.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include "util.h" #include "util.h"
...@@ -368,6 +369,7 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops, ...@@ -368,6 +369,7 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
int nsops) int nsops)
{ {
struct sem *sem; struct sem *sem;
int idx;
if (nsops != 1) { if (nsops != 1) {
/* Complex operation - acquire a full lock */ /* Complex operation - acquire a full lock */
...@@ -385,7 +387,8 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops, ...@@ -385,7 +387,8 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
* *
* Both facts are tracked by use_global_mode. * Both facts are tracked by use_global_mode.
*/ */
sem = &sma->sems[sops->sem_num]; idx = array_index_nospec(sops->sem_num, sma->sem_nsems);
sem = &sma->sems[idx];
/* /*
* Initial check for use_global_lock. Just an optimization, * Initial check for use_global_lock. Just an optimization,
...@@ -638,7 +641,8 @@ static int perform_atomic_semop_slow(struct sem_array *sma, struct sem_queue *q) ...@@ -638,7 +641,8 @@ static int perform_atomic_semop_slow(struct sem_array *sma, struct sem_queue *q)
un = q->undo; un = q->undo;
for (sop = sops; sop < sops + nsops; sop++) { for (sop = sops; sop < sops + nsops; sop++) {
curr = &sma->sems[sop->sem_num]; int idx = array_index_nospec(sop->sem_num, sma->sem_nsems);
curr = &sma->sems[idx];
sem_op = sop->sem_op; sem_op = sop->sem_op;
result = curr->semval; result = curr->semval;
...@@ -718,7 +722,9 @@ static int perform_atomic_semop(struct sem_array *sma, struct sem_queue *q) ...@@ -718,7 +722,9 @@ static int perform_atomic_semop(struct sem_array *sma, struct sem_queue *q)
* until the operations can go through. * until the operations can go through.
*/ */
for (sop = sops; sop < sops + nsops; sop++) { for (sop = sops; sop < sops + nsops; sop++) {
curr = &sma->sems[sop->sem_num]; int idx = array_index_nospec(sop->sem_num, sma->sem_nsems);
curr = &sma->sems[idx];
sem_op = sop->sem_op; sem_op = sop->sem_op;
result = curr->semval; result = curr->semval;
...@@ -1356,6 +1362,7 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum, ...@@ -1356,6 +1362,7 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum,
return -EIDRM; return -EIDRM;
} }
semnum = array_index_nospec(semnum, sma->sem_nsems);
curr = &sma->sems[semnum]; curr = &sma->sems[semnum];
ipc_assert_locked_object(&sma->sem_perm); ipc_assert_locked_object(&sma->sem_perm);
...@@ -1509,6 +1516,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum, ...@@ -1509,6 +1516,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
err = -EIDRM; err = -EIDRM;
goto out_unlock; goto out_unlock;
} }
semnum = array_index_nospec(semnum, nsems);
curr = &sma->sems[semnum]; curr = &sma->sems[semnum];
switch (cmd) { switch (cmd) {
...@@ -2081,7 +2090,8 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops, ...@@ -2081,7 +2090,8 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
*/ */
if (nsops == 1) { if (nsops == 1) {
struct sem *curr; struct sem *curr;
curr = &sma->sems[sops->sem_num]; int idx = array_index_nospec(sops->sem_num, sma->sem_nsems);
curr = &sma->sems[idx];
if (alter) { if (alter) {
if (sma->complex_count) { if (sma->complex_count) {
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment