From a6772f01221682eeb98edb7a9c4d6643e36d19ad Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Wed, 30 Aug 2017 13:41:27 +0300 Subject: [PATCH 77/88] uvcvideo: prevent speculative execution CVE-2017-5753 (Spectre v1 Intel) Since the index value in function uvc_ioctl_enum_input() seems to be controllable by userspace and later on conditionally (upon bound check) used to resolve selector->baSourceID, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Signed-off-by: Andy Whitcroft --- drivers/media/usb/uvc/uvc_v4l2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index 3e7e283a44a8..65175bbe805f 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -821,6 +821,7 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh, } pin = iterm->id; } else if (index < selector->bNrInPins) { + osb(); pin = selector->baSourceID[index]; list_for_each_entry(iterm, &chain->entities, chain) { if (!UVC_ENTITY_IS_ITERM(iterm)) -- 2.15.1