diff mbox series

[2/2] nvme: prevent potential spectre v1 gadget

Message ID 20231128122958.2235-2-nj.shetty@samsung.com
State New
Headers
Series [1/2] nvme: Update type from size_t to u16 for opts->queue_size |

Commit Message

Nitesh Shetty Nov. 28, 2023, 12:29 p.m. UTC 
  This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn:
potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)"
Prevent the contents of kernel memory from being leaked to  user space
via speculative execution by using array_index_nospec.

Signed-off-by: Nitesh Shetty <nj.shetty@samsung.com>
---
 drivers/nvme/target/configfs.c | 3 +++
 1 file changed, 3 insertions(+)

Comments

Sagi Grimberg Nov. 29, 2023, 9:20 a.m. UTC | #1 
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Dan Carpenter Nov. 29, 2023, 9:27 a.m. UTC | #2 
On Tue, Nov 28, 2023 at 05:59:57PM +0530, Nitesh Shetty wrote:
> This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn:
> potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)"
> Prevent the contents of kernel memory from being leaked to  user space
> via speculative execution by using array_index_nospec.
> 
> Signed-off-by: Nitesh Shetty <nj.shetty@samsung.com>
> ---

When it comes to adding array_index_nospec(), then I don't know enough
about it to comment.

regards,
dan carpenter
Nitesh Shetty Nov. 29, 2023, 3:54 p.m. UTC | #3 
On 29/11/23 12:27PM, Dan Carpenter wrote:
>On Tue, Nov 28, 2023 at 05:59:57PM +0530, Nitesh Shetty wrote:
>> This patch fixes the smatch warning, "nvmet_ns_ana_grpid_store() warn:
>> potential spectre issue 'nvmet_ana_group_enabled' [w] (local cap)"
>> Prevent the contents of kernel memory from being leaked to  user space
>> via speculative execution by using array_index_nospec.
>>
>> Signed-off-by: Nitesh Shetty <nj.shetty@samsung.com>
>> ---
>
>When it comes to adding array_index_nospec(), then I don't know enough
>about it to comment.
>
Upon smatch's warning, I referred to kernel documentation[1].
Using array_index_nospec should avoid memory leak.

Thank you,
Nitesh Shetty

[1] https://www.kernel.org/doc/Documentation/speculation.txt
Christoph Hellwig Dec. 4, 2023, 7:42 a.m. UTC | #4 
Looks good:

Reviewed-by: Christoph Hellwig <hch@lst.de>
Keith Busch Dec. 4, 2023, 4:40 p.m. UTC | #5 
Thanks, applied to nvme-6.7.
diff mbox series

Patch

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index e307a044b1a1..d937fe05129e 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c
@@ -18,6 +18,7 @@ 
 #include <linux/nvme-keyring.h>
 #include <crypto/hash.h>
 #include <crypto/kpp.h>
+#include <linux/nospec.h>
 
 #include "nvmet.h"
 
@@ -621,6 +622,7 @@  static ssize_t nvmet_ns_ana_grpid_store(struct config_item *item,
 
 	down_write(&nvmet_ana_sem);
 	oldgrpid = ns->anagrpid;
+	newgrpid = array_index_nospec(newgrpid, NVMET_MAX_ANAGRPS);
 	nvmet_ana_group_enabled[newgrpid]++;
 	ns->anagrpid = newgrpid;
 	nvmet_ana_group_enabled[oldgrpid]--;
@@ -1812,6 +1814,7 @@  static struct config_group *nvmet_ana_groups_make_group(
 	grp->grpid = grpid;
 
 	down_write(&nvmet_ana_sem);
+	grpid = array_index_nospec(grpid, NVMET_MAX_ANAGRPS);
 	nvmet_ana_group_enabled[grpid]++;
 	up_write(&nvmet_ana_sem);