tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

drm/ioc32: stop speculation on the drm_compat_ioctl path

The drm compat ioctl path takes a user controlled pointer, and then
dereferences it into a table of function pointers, the signature method
of spectre problems. Fix this up by calling array_index_nospec() on the
index to the function pointer list.

Fixes: 505b5240329b ("drm/ioctl: Fix Spectre v1 vulnerabilities")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: David Airlie <airlied@gmail.com>
Cc: Simona Vetter <simona@ffwll.ch>
Cc: stable <stable@kernel.org>
Assisted-by: gkh_clanker_2000
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Acked-by: Maxime Ripard <mripard@kernel.org>
Reviewed-by: Simona Vetter <simona@ffwll.ch>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patch.msgid.link/2026032451-playing-rummage-8fa2@gregkh

authored by

Greg Kroah-Hartman and committed by
Thomas Zimmermann f8995c2d 5e77923a

+2
+2
drivers/gpu/drm/drm_ioc32.c
··· 28 28 * IN THE SOFTWARE. 29 29 */ 30 30 #include <linux/compat.h> 31 + #include <linux/nospec.h> 31 32 #include <linux/ratelimit.h> 32 33 #include <linux/export.h> 33 34 ··· 375 374 if (nr >= ARRAY_SIZE(drm_compat_ioctls)) 376 375 return drm_ioctl(filp, cmd, arg); 377 376 377 + nr = array_index_nospec(nr, ARRAY_SIZE(drm_compat_ioctls)); 378 378 fn = drm_compat_ioctls[nr].fn; 379 379 if (!fn) 380 380 return drm_ioctl(filp, cmd, arg);