This is a note to let you know that I've just added the patch titled
prlimit: do_prlimit needs to have a speculation check
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
prlimit-do_prlimit-needs-to-have-a-speculation-check.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 20 Jan 2023 11:03:20 +0100
Subject: prlimit: do_prlimit needs to have a speculation check
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream.
do_prlimit() adds the user-controlled resource value to a pointer that
will subsequently be dereferenced. In order to help prevent this
codepath from being used as a spectre "gadget" a barrier needs to be
added after checking the range.
Reported-by: Jordy Zomer <jordyzomer@xxxxxxxxxx>
Tested-by: Jordy Zomer <jordyzomer@xxxxxxxxxx>
Suggested-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/sys.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1575,6 +1575,8 @@ int do_prlimit(struct task_struct *tsk,
if (resource >= RLIM_NLIMITS)
return -EINVAL;
+ resource = array_index_nospec(resource, RLIM_NLIMITS);
+
if (new_rlim) {
if (new_rlim->rlim_cur > new_rlim->rlim_max)
return -EINVAL;
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-5.15/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch
queue-5.15/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch
queue-5.15/usb-serial-option-add-quectel-em05cn-modem.patch
queue-5.15/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch
queue-5.15/add-exception-protection-processing-for-vd-in-axi_chan_handle_err-function.patch
queue-5.15/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch
queue-5.15/usb-serial-option-add-quectel-em05-g-rs-modem.patch
queue-5.15/usb-serial-option-add-quectel-em05-g-cs-modem.patch
queue-5.15/wifi-brcmfmac-fix-regression-for-broadcom-pcie-wifi-devices.patch
queue-5.15/xhci-fix-null-pointer-dereference-when-host-dies.patch
queue-5.15/nilfs2-fix-general-protection-fault-in-nilfs_btree_insert.patch
queue-5.15/xhci-pci-set-the-dma-max_seg_size.patch
queue-5.15/usb-serial-option-add-quectel-ec200u-modem.patch
queue-5.15/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch
queue-5.15/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch
queue-5.15/usb-serial-option-add-quectel-em05-g-gr-modem.patch
queue-5.15/comedi-adv_pci1760-fix-pwm-instruction-handling.patch
queue-5.15/zonefs-detect-append-writes-at-invalid-locations.patch
queue-5.15/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch
queue-5.15/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch
queue-5.15/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch
queue-5.15/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch
queue-5.15/usb-serial-option-add-quectel-em05cn-sg-modem.patch
queue-5.15/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch
queue-5.15/acpi-prm-check-whether-efi-runtime-is-available.patch
queue-5.15/bluetooth-hci_qca-fix-driver-shutdown-on-closed-serdev.patch
queue-5.15/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch
