aio: fix spectre gadget in lookup_ioctx
authorJeff Moyer <jmoyer@redhat.com>
Tue, 11 Dec 2018 17:37:49 +0000 (12:37 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 21 Dec 2018 13:13:04 +0000 (14:13 +0100)
commit5f4610fe2ed4351b45c0d82b3246f18b886d26f9
treefd1e6aad9e958bab770e26192d17a9c96fe58924
parent7ff0bcb2cb31602dd347b216f5f70851102d5067
aio: fix spectre gadget in lookup_ioctx

commit a538e3ff9dabcdf6c3f477a373c629213d1c3066 upstream.

Matthew pointed out that the ioctx_table is susceptible to spectre v1,
because the index can be controlled by an attacker.  The below patch
should mitigate the attack for all of the aio system calls.

Cc: stable@vger.kernel.org
Reported-by: Matthew Wilcox <willy@infradead.org>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/aio.c