linux

iv/linux

History

Jordy Zomer 5d40f1bdad dma-buf: heaps: Fix potential spectre v1 gadget

commit 92c4cfaee6872038563c5b6f2e8e613f9d84d47d upstream.

It appears like nr could be a Spectre v1 gadget as it's supplied by a
user and used as an array index. Prevent the contents
of kernel memory from being leaked to userspace via speculative
execution by using array_index_nospec.

Signed-off-by: Jordy Zomer <jordy@pwning.systems>
Fixes: c02a81fba74f ("dma-buf: Add dma-buf heaps framework")
Cc: <stable@vger.kernel.org> # v5.6+
Acked-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Sumit Semwal <sumit.semwal@linaro.org>
 [sumits: added fixes and cc: stable tags]
Link: https://patchwork.freedesktop.org/patch/msgid/20220129150604.3461652-1-jordy@pwning.systems
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2022-02-08 18:30:36 +01:00

heaps

dma-mapping updates for 5.10

2020-10-15 14:43:29 -07:00

dma-buf.c

dma-buf: WARN on dmabuf release with pending attachments

2021-11-18 14:03:52 +01:00

dma-fence-array.c

dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled()

2022-01-27 10:53:43 +01:00

dma-fence-chain.c

dma-buf: fence-chain: Document missing dma_fence_chain_init() parameter in kerneldoc