Commit f8995c2d authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Thomas Zimmermann
Browse files

drm/ioc32: stop speculation on the drm_compat_ioctl path 



The drm compat ioctl path takes a user controlled pointer, and then
dereferences it into a table of function pointers, the signature method
of spectre problems.  Fix this up by calling array_index_nospec() on the
index to the function pointer list.

Fixes: 505b5240 ("drm/ioctl: Fix Spectre v1 vulnerabilities")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Acked-by: default avatarMaxime Ripard <mripard@kernel.org>
Reviewed-by: default avatarSimona Vetter <simona@ffwll.ch>
Signed-off-by: default avatarThomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh
parent 5e77923a

drivers/gpu/drm/drm_ioc32.c

+2 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ 
 * IN THE SOFTWARE.

 */

#include <linux/compat.h>

#include <linux/nospec.h>

#include <linux/ratelimit.h>

#include <linux/export.h>
@@ -374,6 +375,7 @@ long drm_compat_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) 
	if (nr >= ARRAY_SIZE(drm_compat_ioctls))

		return drm_ioctl(filp, cmd, arg);



	nr = array_index_nospec(nr, ARRAY_SIZE(drm_compat_ioctls));

	fn = drm_compat_ioctls[nr].fn;

	if (!fn)

		return drm_ioctl(filp, cmd, arg);