This is a note to let you know that I've just added the patch titled prlimit: do_prlimit needs to have a speculation check to the 5.15-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: prlimit-do_prlimit-needs-to-have-a-speculation-check.patch and it can be found in the queue-5.15 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Date: Fri, 20 Jan 2023 11:03:20 +0100 Subject: prlimit: do_prlimit needs to have a speculation check From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream. do_prlimit() adds the user-controlled resource value to a pointer that will subsequently be dereferenced. In order to help prevent this codepath from being used as a spectre "gadget" a barrier needs to be added after checking the range. Reported-by: Jordy Zomer <jordyzomer@xxxxxxxxxx> Tested-by: Jordy Zomer <jordyzomer@xxxxxxxxxx> Suggested-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/sys.c | 2 ++ 1 file changed, 2 insertions(+) --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1575,6 +1575,8 @@ int do_prlimit(struct task_struct *tsk, if (resource >= RLIM_NLIMITS) return -EINVAL; + resource = array_index_nospec(resource, RLIM_NLIMITS); + if (new_rlim) { if (new_rlim->rlim_cur > new_rlim->rlim_max) return -EINVAL; Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are queue-5.15/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch queue-5.15/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch queue-5.15/usb-serial-option-add-quectel-em05cn-modem.patch queue-5.15/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch queue-5.15/add-exception-protection-processing-for-vd-in-axi_chan_handle_err-function.patch queue-5.15/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch queue-5.15/usb-serial-option-add-quectel-em05-g-rs-modem.patch queue-5.15/usb-serial-option-add-quectel-em05-g-cs-modem.patch queue-5.15/wifi-brcmfmac-fix-regression-for-broadcom-pcie-wifi-devices.patch queue-5.15/xhci-fix-null-pointer-dereference-when-host-dies.patch queue-5.15/nilfs2-fix-general-protection-fault-in-nilfs_btree_insert.patch queue-5.15/xhci-pci-set-the-dma-max_seg_size.patch queue-5.15/usb-serial-option-add-quectel-ec200u-modem.patch queue-5.15/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch queue-5.15/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch queue-5.15/usb-serial-option-add-quectel-em05-g-gr-modem.patch queue-5.15/comedi-adv_pci1760-fix-pwm-instruction-handling.patch queue-5.15/zonefs-detect-append-writes-at-invalid-locations.patch queue-5.15/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch queue-5.15/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch queue-5.15/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch queue-5.15/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch queue-5.15/usb-serial-option-add-quectel-em05cn-sg-modem.patch queue-5.15/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch queue-5.15/acpi-prm-check-whether-efi-runtime-is-available.patch queue-5.15/bluetooth-hci_qca-fix-driver-shutdown-on-closed-serdev.patch queue-5.15/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch