Commit d795848e authored by Hagar Hemdan's avatar Hagar Hemdan Committed by Bartosz Golaszewski
Browse files

gpio: prevent potential speculation leaks in gpio_device_get_desc() 



Userspace may trigger a speculative read of an address outside the gpio
descriptor array.
Users can do that by calling gpio_ioctl() with an offset out of range.
Offset is copied from user and then used as an array index to get
the gpio descriptor without sanitization in gpio_device_get_desc().

This change ensures that the offset is sanitized by using
array_index_nospec() to mitigate any possibility of speculative
information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Signed-off-by: default avatarHagar Hemdan <hagarhem@amazon.com>
Link: https://lore.kernel.org/r/20240523085332.1801-1-hagarhem@amazon.com


Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
parent 447e140e

drivers/gpio/gpiolib.c

+2 −1
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 
#include <linux/list.h>

#include <linux/lockdep.h>

#include <linux/module.h>

#include <linux/nospec.h>

#include <linux/of.h>

#include <linux/pinctrl/consumer.h>

#include <linux/seq_file.h>
@@ -198,7 +199,7 @@ gpio_device_get_desc(struct gpio_device *gdev, unsigned int hwnum) 
	if (hwnum >= gdev->ngpio)

		return ERR_PTR(-EINVAL);



	return &gdev->descs[hwnum];

	return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)];

}

EXPORT_SYMBOL_GPL(gpio_device_get_desc);