This is a note to let you know that I've just added the patch titled prlimit: do_prlimit needs to have a speculation check to the 6.1-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: prlimit-do_prlimit-needs-to-have-a-speculation-check.patch and it can be found in the queue-6.1 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 739790605705ddcf18f21782b9c99ad7d53a8c11 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Date: Fri, 20 Jan 2023 11:03:20 +0100 Subject: prlimit: do_prlimit needs to have a speculation check From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> commit 739790605705ddcf18f21782b9c99ad7d53a8c11 upstream. do_prlimit() adds the user-controlled resource value to a pointer that will subsequently be dereferenced. In order to help prevent this codepath from being used as a spectre "gadget" a barrier needs to be added after checking the range. Reported-by: Jordy Zomer <jordyzomer@xxxxxxxxxx> Tested-by: Jordy Zomer <jordyzomer@xxxxxxxxxx> Suggested-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/sys.c | 2 ++ 1 file changed, 2 insertions(+) --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct if (resource >= RLIM_NLIMITS) return -EINVAL; + resource = array_index_nospec(resource, RLIM_NLIMITS); + if (new_rlim) { if (new_rlim->rlim_cur > new_rlim->rlim_max) return -EINVAL; Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are queue-6.1/nommu-fix-do_munmap-error-path.patch queue-6.1/usb-acpi-add-helper-to-check-port-lpm-capability-using-acpi-_dsm.patch queue-6.1/staging-vchiq_arm-fix-enum-vchiq_status-return-types.patch queue-6.1/usb-serial-option-add-quectel-em05cn-modem.patch queue-6.1/misc-fastrpc-don-t-remove-map-on-creater_process-and-device_release.patch queue-6.1/serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch queue-6.1/add-exception-protection-processing-for-vd-in-axi_chan_handle_err-function.patch queue-6.1/misc-fastrpc-fix-use-after-free-race-condition-for-maps.patch queue-6.1/usb-serial-option-add-quectel-em05-g-rs-modem.patch queue-6.1/usb-serial-option-add-quectel-em05-g-cs-modem.patch queue-6.1/wifi-brcmfmac-fix-regression-for-broadcom-pcie-wifi-devices.patch queue-6.1/xhci-fix-null-pointer-dereference-when-host-dies.patch queue-6.1/usb-misc-onboard_hub-invert-driver-registration-order.patch queue-6.1/nilfs2-fix-general-protection-fault-in-nilfs_btree_insert.patch queue-6.1/loongarch-add-hwcap_loongarch_cpucfg-to-elf_hwcap.patch queue-6.1/xhci-pci-set-the-dma-max_seg_size.patch queue-6.1/usb-serial-option-add-quectel-ec200u-modem.patch queue-6.1/usb-xhci-check-endpoint-is-valid-before-dereferencing-it.patch queue-6.1/wifi-mac80211-reset-multiple-bssid-options-in-stop_ap.patch queue-6.1/usb-misc-iowarrior-fix-up-header-size-for-usb_device_id_codemercs_iow100.patch queue-6.1/usb-serial-option-add-quectel-em05-g-gr-modem.patch queue-6.1/comedi-adv_pci1760-fix-pwm-instruction-handling.patch queue-6.1/zonefs-detect-append-writes-at-invalid-locations.patch queue-6.1/nommu-fix-memory-leak-in-do_mmap-error-path.patch queue-6.1/wifi-mac80211-sdata-can-be-null-during-ampdu-start.patch queue-6.1/usb-core-hub-disable-autosuspend-for-ti-tusb8041.patch queue-6.1/proc-fix-pie-proc-empty-vm-proc-pid-vm-tests.patch queue-6.1/revert-serial-stm32-merge-hard-irq-and-threaded-irq-handling-into-single-irq-handler.patch queue-6.1/usb-misc-onboard_hub-move-attach-work-to-the-driver.patch queue-6.1/wifi-mac80211-fix-initialization-of-rx-link-and-rx-link_sta.patch queue-6.1/xhci-add-update_hub_device-override-for-pci-xhci-hosts.patch queue-6.1/prlimit-do_prlimit-needs-to-have-a-speculation-check.patch queue-6.1/usb-serial-option-add-quectel-em05cn-sg-modem.patch queue-6.1/hugetlb-unshare-some-pmds-when-splitting-vmas.patch queue-6.1/xhci-detect-lpm-incapable-xhc-usb3-roothub-ports-from-acpi-tables.patch queue-6.1/acpi-prm-check-whether-efi-runtime-is-available.patch queue-6.1/wifi-mac80211-fix-mlo-ap_vlan-check.patch queue-6.1/nommu-fix-split_vma-map_count-error.patch queue-6.1/mm-khugepaged-fix-collapse_pte_mapped_thp-to-allow-anon_vma.patch queue-6.1/bluetooth-hci_qca-fix-driver-shutdown-on-closed-serdev.patch queue-6.1/bluetooth-hci_sync-fix-use-hci_op_le_read_buffer_size_v2.patch queue-6.1/misc-fastrpc-fix-use-after-free-and-race-in-fastrpc_map_find.patch queue-6.1/xhci-add-a-flag-to-disable-usb3-lpm-on-a-xhci-root-port-level.patch queue-6.1/mm-shmem-restore-shmem_huge_deny-precedence-over-madv_collapse.patch