diff options
| author | Lukas Gerlach <lukas.gerlach@cispa.de> | 2025-12-18 20:13:32 +0100 |
|---|---|---|
| committer | Paul Walmsley <pjw@kernel.org> | 2025-12-30 19:57:55 -0700 |
| commit | 25fd7ee7bf58ac3ec7be3c9f82ceff153451946c (patch) | |
| tree | a2cbd65e3fbd522159d9d6bdb413d7f171b8c9ca /arch | |
| parent | 66562b66dcbc8f93c1e28632299f449bb2f5c47d (diff) | |
riscv: Sanitize syscall table indexing under speculation
The syscall number is a user-controlled value used to index into the
syscall table. Use array_index_nospec() to clamp this value after the
bounds check to prevent speculative out-of-bounds access and subsequent
data leakage via cache side channels.
Signed-off-by: Lukas Gerlach <lukas.gerlach@cispa.de>
Link: https://patch.msgid.link/20251218191332.35849-3-lukas.gerlach@cispa.de
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Diffstat (limited to 'arch')
| -rw-r--r-- | arch/riscv/kernel/traps.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/arch/riscv/kernel/traps.c b/arch/riscv/kernel/traps.c index 80230de167de..47afea4ff1a8 100644 --- a/arch/riscv/kernel/traps.c +++ b/arch/riscv/kernel/traps.c @@ -339,8 +339,10 @@ void do_trap_ecall_u(struct pt_regs *regs) add_random_kstack_offset(); - if (syscall >= 0 && syscall < NR_syscalls) + if (syscall >= 0 && syscall < NR_syscalls) { + syscall = array_index_nospec(syscall, NR_syscalls); syscall_handler(regs, syscall); + } /* * Ultimately, this value will get limited by KSTACK_OFFSET_MAX(), |