]> www.infradead.org Git - users/jedix/linux-maple.git/commit
uvcvideo: prevent speculative execution
authorElena Reshetova <elena.reshetova@intel.com>
Thu, 4 Jan 2018 09:25:32 +0000 (01:25 -0800)
committerKirtikar Kashyap <kirtikar.kashyap@oracle.com>
Fri, 12 Jan 2018 18:20:00 +0000 (10:20 -0800)
commitdde52918b1f284e5da3ea3907d730bb819f80216
tree54d698df8c10b9c025b7282de19e15ec91d08d23
parent7b348358b7b8dc968e309300a2218f8a39432454
uvcvideo: prevent speculative execution

Since the index value in function uvc_ioctl_enum_input()
seems to be controllable by userspace and later on
conditionally (upon bound check) used to resolve
selector->baSourceID, insert an observable speculation
barrier before its usage. This should prevent
observable speculation on that branch and avoid
kernel memory leak.

Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
Orabug: 27340445
CVE: CVE-2017-5753

Signed-off-by: Chuck Anderson <chuck.anderson@oracle.com>
Reviewed-by: John Haxby <john.haxby@oracle.com>
Signed-off-by: Kirtikar Kashyap <kirtikar.kashyap@oracle.com>
drivers/media/usb/uvc/uvc_v4l2.c