leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f99fb607fb
linux/drivers/usb/gadget/function
History
Gustavo A. R. Silva 9ae24af366 usb: gadget: storage: Fix Spectre v1 vulnerability 
num can be indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

drivers/usb/gadget/function/f_mass_storage.c:3177 fsg_lun_make() warn:
potential spectre issue 'fsg_opts->common->luns' [r] (local cap)

Fix this by sanitizing num before using it to index
fsg_opts->common->luns

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Acked-by: Felipe Balbi <felipe.balbi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-10-17 20:57:55 +02:00
..
f_acm.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_ecm.c usb: gadget: f_ecm: fix host mac address for multiple instances 2018-05-15 10:17:18 +03:00
f_eem.c net: drivers/net: Remove unnecessary skb_copy_expand OOM messages 2018-03-15 14:28:03 -04:00
f_fs.c usb: gadget: f_fs: Only return delayed status when len is 0 2018-07-26 13:44:24 +03:00
f_hid.c vfs: do bulk POLL* -> EPOLL* replacement 2018-02-11 14:34:03 -08:00
f_loopback.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_mass_storage.c usb: gadget: storage: Fix Spectre v1 vulnerability 2018-10-17 20:57:55 +02:00
f_mass_storage.h usb: gadget: storage: Remove reference counting 2018-07-26 13:55:39 +03:00
f_midi.c - Introduce arithmetic overflow test helper functions (Rasmus) 2018-06-06 17:27:14 -07:00
f_ncm.c usb/gadget/NCM: Replace tasklet with softirq hrtimer 2018-01-16 09:51:23 +01:00
f_obex.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_phonet.c usb: gadget: f_phonet: fix pn_net_xmit()'s return type 2018-05-21 10:36:14 +03:00
f_printer.c usb: gadget: function: printer: avoid wrong list handling in printer_write() 2018-05-24 18:14:28 +02:00
f_rndis.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_serial.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_sourcesink.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_subset.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_tcm.c scsi: target: loop, usb, vhost, xen: use target_remove_session 2018-08-02 15:29:31 -04:00
f_uac1_legacy.c usb: Remove Blackfin references in USB support 2018-03-26 15:57:16 +02:00
f_uac1.c A couple of configfs cleanups: 2017-11-14 14:44:04 -08:00
f_uac2.c usb: gadget: f_uac2: fix endianness of 'struct cntrl_*_lay3' 2018-07-17 10:12:52 +03:00
f_uvc.c usb: gadget: uvc: Expose configuration name through video node 2018-07-26 13:43:18 +03:00
f_uvc.h usb: gadget: uvc: Minimize #include in headers 2018-07-26 13:33:44 +03:00
g_zero.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ndis.h
rndis.c USB: rndis: Fix for handling garbled messages 2018-05-15 10:24:28 +03:00
rndis.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
storage_common.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
storage_common.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tcm.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
u_audio.c usb: gadget: u_audio: protect stream runtime fields with stream spinlock 2018-07-17 10:12:51 +03:00
u_audio.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ecm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_eem.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ether_configfs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ether.c USB: Gadget Ethernet: Re-enable Jumbo frames. 2018-05-15 10:17:14 +03:00
u_ether.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_fs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_gether.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_hid.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_midi.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_ncm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_phonet.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_printer.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_rndis.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_serial.c usb: gadget: u_serial: Use kfifo instead of homemade circular buffer 2017-12-11 12:36:50 +02:00
u_serial.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_tcm.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac1_legacy.c usb: Remove Blackfin references in USB support 2018-03-26 15:57:16 +02:00
u_uac1_legacy.h usb: Remove Blackfin references in USB support 2018-03-26 15:57:16 +02:00
u_uac1.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uac2.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
u_uvc.h usb: gadget: uvc: Move trace parameter to function module 2018-07-26 13:33:48 +03:00
uvc_configfs.c usb: gadget: uvc: configfs: Move function to avoid forward declaration 2018-07-26 13:40:34 +03:00
uvc_configfs.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_queue.c media: annotate ->poll() instances 2017-11-27 16:20:06 -05:00
uvc_queue.h usb: gadget: uvc: Minimize #include in headers 2018-07-26 13:33:44 +03:00
uvc_v4l2.c usb: gadget: uvc: Minimize #include in headers 2018-07-26 13:33:44 +03:00
uvc_v4l2.h USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_video.c USB: gadget: function: Remove redundant license text 2017-11-07 15:45:02 +01:00
uvc_video.h usb: gadget: uvc: Minimize #include in headers 2018-07-26 13:33:44 +03:00
uvc.h usb: gadget: uvc: Minimize #include in headers 2018-07-26 13:33:44 +03:00