Documentation: Move L1TF to separate directory

[mirror_ubuntu-bionic-kernel.git] / ipc / sem.c

diff --git a/ipc/sem.c b/ipc/sem.c
index b2698ebdcb31e65ea2f3e94f64cc567607b8ca2a..1b82bd336dccecefe761b26668da3f73ab176b1b 100644 (file)
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -84,6 +84,7 @@
 #include <linux/nsproxy.h>
 #include <linux/ipc_namespace.h>
 #include <linux/sched/wake_q.h>
+#include <linux/nospec.h>
 
 #include <linux/uaccess.h>
 #include "util.h"
@@ -333,6 +334,7 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
                              int nsops)
 {
        struct sem *sem;
+       int idx;
 
        if (nsops != 1) {
                /* Complex operation - acquire a full lock */
@@ -350,7 +352,8 @@ static inline int sem_lock(struct sem_array *sma, struct sembuf *sops,
         *
         * Both facts are tracked by use_global_mode.
         */
-       sem = &sma->sems[sops->sem_num];
+       idx = array_index_nospec(sops->sem_num, sma->sem_nsems);
+       sem = &sma->sems[idx];
 
        /*
         * Initial check for use_global_lock. Just an optimization,
@@ -515,6 +518,7 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
        sma->sem_nsems = nsems;
        sma->sem_ctime = ktime_get_real_seconds();
 
+       /* ipc_addid() locks sma upon success. */
        retval = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
        if (retval < 0) {
                call_rcu(&sma->sem_perm.rcu, sem_rcu_free);
@@ -607,7 +611,8 @@ static int perform_atomic_semop_slow(struct sem_array *sma, struct sem_queue *q)
        un = q->undo;
 
        for (sop = sops; sop < sops + nsops; sop++) {
-               curr = &sma->sems[sop->sem_num];
+               int idx = array_index_nospec(sop->sem_num, sma->sem_nsems);
+               curr = &sma->sems[idx];
                sem_op = sop->sem_op;
                result = curr->semval;
 
@@ -687,7 +692,9 @@ static int perform_atomic_semop(struct sem_array *sma, struct sem_queue *q)
         * until the operations can go through.
         */
        for (sop = sops; sop < sops + nsops; sop++) {
-               curr = &sma->sems[sop->sem_num];
+               int idx = array_index_nospec(sop->sem_num, sma->sem_nsems);
+
+               curr = &sma->sems[idx];
                sem_op = sop->sem_op;
                result = curr->semval;
 
@@ -1303,6 +1310,7 @@ static int semctl_setval(struct ipc_namespace *ns, int semid, int semnum,
                return -EIDRM;
        }
 
+       semnum = array_index_nospec(semnum, sma->sem_nsems);
        curr = &sma->sems[semnum];
 
        ipc_assert_locked_object(&sma->sem_perm);
@@ -1456,6 +1464,8 @@ static int semctl_main(struct ipc_namespace *ns, int semid, int semnum,
                err = -EIDRM;
                goto out_unlock;
        }
+
+       semnum = array_index_nospec(semnum, nsems);
        curr = &sma->sems[semnum];
 
        switch (cmd) {
@@ -1637,10 +1647,10 @@ static int copy_compat_semid_from_user(struct semid64_ds *out, void __user *buf,
 {
        memset(out, 0, sizeof(*out));
        if (version == IPC_64) {
-               struct compat_semid64_ds *p = buf;
+               struct compat_semid64_ds __user *p = buf;
                return get_compat_ipc64_perm(&out->sem_perm, &p->sem_perm);
        } else {
-               struct compat_semid_ds *p = buf;
+               struct compat_semid_ds __user *p = buf;
                return get_compat_ipc_perm(&out->sem_perm, &p->sem_perm);
        }
 }
@@ -2014,7 +2024,8 @@ static long do_semtimedop(int semid, struct sembuf __user *tsops,
         */
        if (nsops == 1) {
                struct sem *curr;
-               curr = &sma->sems[sops->sem_num];
+               int idx = array_index_nospec(sops->sem_num, sma->sem_nsems);
+               curr = &sma->sems[idx];
 
                if (alter) {
                        if (sma->complex_count) {