]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
media: dvb_ca_en50221: prevent using slot_info for Spectre attacs
authorMauro Carvalho Chehab <mchehab+samsung@kernel.org>
Tue, 15 May 2018 12:31:38 +0000 (08:31 -0400)
committerStefan Bader <stefan.bader@canonical.com>
Wed, 24 Apr 2019 08:06:41 +0000 (10:06 +0200)
commitfd1daf2ec753d3b176ab352d4c639e28b7ed2007
tree85e008f87a2fb958c5872b8aab7d426fc870ea29
parent52130c438ba934bb7549dcbe8af5ac483e3bfc3b
media: dvb_ca_en50221: prevent using slot_info for Spectre attacs

slot can be controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability,
as warned by smatch:
drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write() warn: potential spectre issue 'ca->slot_info' (local cap)

Acked-by: "Jasmin J." <jasmin@anw.at>
Signed-off-by: Mauro Carvalho Chehab <mchehab+samsung@kernel.org>
CVE-2017-5753

(backported from commit 4f5ab5d7a5e765ad231a132f82cec71de88b9aad)
[juergh:
 - Adjusted context.
 - Folded in a24e6348e5a0 ("media: dvb_ca_en50221: sanity check slot number from userspace").]
Signed-off-by: Juerg Haefliger <juergh@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
drivers/media/dvb-core/dvb_ca_en50221.c