iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ALSA: opl3: Hardening for potential Spectre v1

Browse Source 
As recently Smatch suggested, one place in OPL3 driver may expand the
array directly from the user-space value with speculation:
  sound/drivers/opl3/opl3_synth.c:476 snd_opl3_set_voice() warn: potential spectre issue 'snd_opl3_regmap'

This patch puts array_index_nospec() for hardening against it.

BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
This commit is contained in:
Takashi Iwai 2018-04-24 07:56:07 +02:00
parent 69fa6f19b9
commit 7f054a5bee
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
sound/drivers/opl3/opl3_synth.c
View File

@ -21,6 +21,7 @@
#include <linux/slab.h>
#include <linux/export.h>
#include <linux/nospec.h>
#include <sound/opl3.h>
#include <sound/asound_fm.h>
@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
{
unsigned short reg_side;
unsigned char op_offset;
unsigned char voice_offset;
unsigned char voice_offset, voice_op;
unsigned short opl3_reg;
unsigned char reg_val;
@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
voice_offset = voice->voice - MAX_OPL2_VOICES;
}
/* Get register offset of operator */
op_offset = snd_opl3_regmap[voice_offset][voice->op];
voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES);
voice_op = array_index_nospec(voice->op, 4);
op_offset = snd_opl3_regmap[voice_offset][voice_op];
reg_val = 0x00;
/* Set amplitude modulation (tremolo) effect */