The clockid argument of clockid_to_kclock() comes straight from user space via various syscalls and is used as index into the posix_clocks array. Protect it against spectre v1 array out of bounds speculation. Remove the redundant check for !posix_clock[id] as this is another source for speculation and does not provide any advantage over the return posix_clock[id] path which returns NULL in that case anyway.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -50,6 +50,7 @@ · 49 unmodified lines | ||
| 50 | 50 | #include <linux/export.h> |
| 51 | 51 | #include <linux/hashtable.h> |
| 52 | 52 | #include <linux/compat.h> |
| 53 | +#include <linux/nospec.h> | |
| 53 | 54 | |
| 54 | 55 | #include "timekeeping.h" |
| 55 | 56 | #include "posix-timers.h" |
| @@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = { · 1290 unmodified lines | ||
| 1346 | 1347 | |
| 1347 | 1348 | static const struct k_clock *clockid_to_kclock(const clockid_t id) |
| 1348 | 1349 | { |
| 1349 | − if (id < 0) | |
| 1350 | + clockid_t idx = id; | |
| 1351 | + | |
| 1352 | + if (id < 0) { | |
| 1350 | 1353 | return (id & CLOCKFD_MASK) == CLOCKFD ? |
| 1351 | 1354 | &clock_posix_dynamic : &clock_posix_cpu; |
| 1355 | + } | |
| 1352 | 1356 | |
| 1353 | − if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id]) | |
| 1357 | + if (id >= ARRAY_SIZE(posix_clocks)) | |
| 1354 | 1358 | return NULL; |
| 1355 | − return posix_clocks[id]; | |
| 1359 | + | |
| 1360 | + return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))]; | |
| 1356 | 1361 | } |