The clockid argument of clockid_to_kclock() comes straight from user space via various syscalls and is used as index into the posix_clocks array. Protect it against spectre v1 array out of bounds speculation. Remove the redundant check for !posix_clock[id] as this is another source for speculation and does not provide any advantage over the return posix_clock[id] path which returns NULL in that case anyway.
Unified · Split
| @@ -50,6 +50,7 @@ · 49 unmodified lines | |||
| 50 | #include <linux/export.h> | 50 | #include <linux/export.h> |
| 51 | #include <linux/hashtable.h> | 51 | #include <linux/hashtable.h> |
| 52 | #include <linux/compat.h> | 52 | #include <linux/compat.h> |
| 53 | #include <linux/nospec.h> | ||
| 53 | 54 | ||
| 54 | #include "timekeeping.h" | 55 | #include "timekeeping.h" |
| 55 | #include "posix-timers.h" | 56 | #include "posix-timers.h" |
| @@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = { · 1290 unmodified lines | |||
| 1346 | 1347 | ||
| 1347 | static const struct k_clock *clockid_to_kclock(const clockid_t id) | 1348 | static const struct k_clock *clockid_to_kclock(const clockid_t id) |
| 1348 | { | 1349 | { |
| 1349 | if (id < 0) | 1350 | clockid_t idx = id; |
| 1351 | |||
| 1352 | if (id < 0) { | ||
| 1350 | return (id & CLOCKFD_MASK) == CLOCKFD ? | 1353 | return (id & CLOCKFD_MASK) == CLOCKFD ? |
| 1351 | &clock_posix_dynamic : &clock_posix_cpu; | 1354 | &clock_posix_dynamic : &clock_posix_cpu; |
| 1355 | } | ||
| 1352 | 1356 | ||
| 1353 | if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id]) | 1357 | if (id >= ARRAY_SIZE(posix_clocks)) |
| 1354 | return NULL; | 1358 | return NULL; |
| 1355 | return posix_clocks[id]; | 1359 | |
| 1360 | return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))]; | ||
| 1356 | } | 1361 | } |