Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'drm-fixes-2018-12-21' of git://anongit.freedesktop.org/drm/drm
Pull final drm fix from Daniel Vetter:
"Very calm week, so either everything perfect or everyone on holidays
already. Just one array_index_nospec patch, also for stable"
* tag 'drm-fixes-2018-12-21' of git://anongit.freedesktop.org/drm/drm:
drm/ioctl: Fix Spectre v1 vulnerabilities
+8
-2
+8
-2
drivers/gpu/drm/drm_ioctl.c
+8
-2
drivers/gpu/drm/drm_ioctl.c
···
37
37
38
38
#include <linux/pci.h>
39
39
#include <linux/export.h>
40
+
#include <linux/nospec.h>
40
41
41
42
/**
42
43
* DOC: getunique and setversion story
···
801
800
802
801
if (is_driver_ioctl) {
803
802
/* driver ioctl */
804
-
if (nr - DRM_COMMAND_BASE >= dev->driver->num_ioctls)
803
+
unsigned int index = nr - DRM_COMMAND_BASE;
804
+
805
+
if (index >= dev->driver->num_ioctls)
805
806
goto err_i1;
806
-
ioctl = &dev->driver->ioctls[nr - DRM_COMMAND_BASE];
807
+
index = array_index_nospec(index, dev->driver->num_ioctls);
808
+
ioctl = &dev->driver->ioctls[index];
807
809
} else {
808
810
/* core ioctl */
809
811
if (nr >= DRM_CORE_IOCTL_COUNT)
810
812
goto err_i1;
813
+
nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
811
814
ioctl = &drm_ioctls[nr];
812
815
}
813
816
···
893
888
894
889
if (nr >= DRM_CORE_IOCTL_COUNT)
895
890
return false;
891
+
nr = array_index_nospec(nr, DRM_CORE_IOCTL_COUNT);
896
892
897
893
*flags = drm_ioctls[nr].flags;
898
894
return true;