Commit eb6d938f authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman

Merge tag 'for-gkh' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma

Doug writes:
  "Really final for-rc pull request for 4.19

   Ok, so last week I thought we had sent our final pull request for
   4.19.  Well, wouldn't ya know someone went and found a couple Spectre
   v1 fixes were needed :-/.  So, a couple *very* small specter patches
   for this (hopefully) final -rc week."

* tag 'for-gkh' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma:
  RDMA/ucma: Fix Spectre v1 vulnerability
  IB/ucm: Fix Spectre v1 vulnerability
parents fa520c47 a3671a4f
...@@ -46,6 +46,8 @@ ...@@ -46,6 +46,8 @@
#include <linux/mutex.h> #include <linux/mutex.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/nospec.h>
#include <linux/uaccess.h> #include <linux/uaccess.h>
#include <rdma/ib.h> #include <rdma/ib.h>
...@@ -1120,6 +1122,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, ...@@ -1120,6 +1122,7 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf,
if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table)) if (hdr.cmd >= ARRAY_SIZE(ucm_cmd_table))
return -EINVAL; return -EINVAL;
hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucm_cmd_table));
if (hdr.in + sizeof(hdr) > len) if (hdr.in + sizeof(hdr) > len)
return -EINVAL; return -EINVAL;
......
...@@ -44,6 +44,8 @@ ...@@ -44,6 +44,8 @@
#include <linux/module.h> #include <linux/module.h>
#include <linux/nsproxy.h> #include <linux/nsproxy.h>
#include <linux/nospec.h>
#include <rdma/rdma_user_cm.h> #include <rdma/rdma_user_cm.h>
#include <rdma/ib_marshall.h> #include <rdma/ib_marshall.h>
#include <rdma/rdma_cm.h> #include <rdma/rdma_cm.h>
...@@ -1676,6 +1678,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, ...@@ -1676,6 +1678,7 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf,
if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table)) if (hdr.cmd >= ARRAY_SIZE(ucma_cmd_table))
return -EINVAL; return -EINVAL;
hdr.cmd = array_index_nospec(hdr.cmd, ARRAY_SIZE(ucma_cmd_table));
if (hdr.in + sizeof(hdr) > len) if (hdr.in + sizeof(hdr) > len)
return -EINVAL; return -EINVAL;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment