Skip to content

Commit f526afc

Browse files
committed
ALSA: rme9652: Hardening for potential Spectre v1
As recently Smatch suggested, one place in RME9652 driver may expand the array directly from the user-space value with speculation: sound/pci/rme9652/rme9652.c:2074 snd_rme9652_channel_info() warn: potential spectre issue 'rme9652->channel_map' (local cap) This patch puts array_index_nospec() for hardening against it. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <[email protected]> Cc: <[email protected]> Signed-off-by: Takashi Iwai <[email protected]>
1 parent 1051314 commit f526afc

File tree

1 file changed

+4
-2
lines changed

1 file changed

+4
-2
lines changed

sound/pci/rme9652/rme9652.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#include <linux/pci.h>
2727
#include <linux/module.h>
2828
#include <linux/io.h>
29+
#include <linux/nospec.h>
2930

3031
#include <sound/core.h>
3132
#include <sound/control.h>
@@ -2071,9 +2072,10 @@ static int snd_rme9652_channel_info(struct snd_pcm_substream *substream,
20712072
if (snd_BUG_ON(info->channel >= RME9652_NCHANNELS))
20722073
return -EINVAL;
20732074

2074-
if ((chn = rme9652->channel_map[info->channel]) < 0) {
2075+
chn = rme9652->channel_map[array_index_nospec(info->channel,
2076+
RME9652_NCHANNELS)];
2077+
if (chn < 0)
20752078
return -EINVAL;
2076-
}
20772079

20782080
info->offset = chn * RME9652_CHANNEL_BUFFER_BYTES;
20792081
info->first = 0;

0 commit comments

Comments
 (0)