diff options
| author | Mark Rutland <mark.rutland@arm.com> | 2018-07-10 19:01:22 +0100 |
|---|---|---|
| committer | Will Deacon <will.deacon@arm.com> | 2018-07-23 14:49:14 +0100 |
| commit | 14d6e289a89780377f8bb09de8926d3c62d763cd (patch) | |
| tree | 7d8c11258a34c3d2576122ff5566c62456f98f59 /arch/arm64/kernel/ptrace.c | |
| parent | 11527b3e0b577513ea318f01e392ccf7feb9d2a4 (diff) | |
arm64: fix possible spectre-v1 write in ptrace_hbp_set_event()
It's possible for userspace to control idx. Sanitize idx when using it
as an array index, to inhibit the potential spectre-v1 write gadget.
Found by smatch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Diffstat (limited to 'arch/arm64/kernel/ptrace.c')
| -rw-r--r-- | arch/arm64/kernel/ptrace.c | 19 |
1 files changed, 11 insertions, 8 deletions
diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c index 379b2b714193..299758f9b9c4 100644 --- a/arch/arm64/kernel/ptrace.c +++ b/arch/arm64/kernel/ptrace.c @@ -277,19 +277,22 @@ static int ptrace_hbp_set_event(unsigned int note_type, switch (note_type) { case NT_ARM_HW_BREAK: - if (idx < ARM_MAX_BRP) { - tsk->thread.debug.hbp_break[idx] = bp; - err = 0; - } + if (idx >= ARM_MAX_BRP) + goto out; + idx = array_index_nospec(idx, ARM_MAX_BRP); + tsk->thread.debug.hbp_break[idx] = bp; + err = 0; break; case NT_ARM_HW_WATCH: - if (idx < ARM_MAX_WRP) { - tsk->thread.debug.hbp_watch[idx] = bp; - err = 0; - } + if (idx >= ARM_MAX_WRP) + goto out; + idx = array_index_nospec(idx, ARM_MAX_WRP); + tsk->thread.debug.hbp_watch[idx] = bp; + err = 0; break; } +out: return err; } |