From dde52918b1f284e5da3ea3907d730bb819f80216 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 01:25:32 -0800 Subject: [PATCH] uvcvideo: prevent speculative execution Since the index value in function uvc_ioctl_enum_input() seems to be controllable by userspace and later on conditionally (upon bound check) used to resolve selector->baSourceID, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- drivers/media/usb/uvc/uvc_v4l2.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c index c4b1ac6750d8..adad6ffe2ec1 100644 --- a/drivers/media/usb/uvc/uvc_v4l2.c +++ b/drivers/media/usb/uvc/uvc_v4l2.c @@ -802,6 +802,7 @@ static int uvc_ioctl_enum_input(struct file *file, void *fh, } pin = iterm->id; } else if (index < selector->bNrInPins) { + osb(); pin = selector->baSourceID[index]; list_for_each_entry(iterm, &chain->entities, chain) { if (!UVC_ENTITY_IS_ITERM(iterm)) -- 2.50.1