vmci: prevent speculation leaks by sanitizing event in event_deliver()

Coverity spotted that event_msg is controlled by user-space,
event_msg->event_data.event is passed to event_deliver() and used
as an index without sanitization.

This change ensures that the event index is sanitized to mitigate any
possibility of speculative information leaks.

This bug was discovered and resolved using Coverity Static Analysis
Security Testing (SAST) by Synopsys, Inc.

Only compile tested, no access to HW.

Fixes: 1d990201f9bb ("VMCI: event handling implementation.")
Cc: stable <[email protected]>
Signed-off-by: Hagar Gamal Halim Hemdan <[email protected]>
Link: https://lore.kernel.org/stable/20231127193533.46174-1-hagarhem%40amazon.com
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c
index 5d7ac07623c27330d42a37686329293b2761ef67..9a41ab65378de0fdc77949ef46cc9dc21ba37943 100644 (file)
--- a/drivers/misc/vmw_vmci/vmci_event.c
+++ b/drivers/misc/vmw_vmci/vmci_event.c
@@ -9,6 +9,7 @@
 #include <linux/vmw_vmci_api.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/rculist.h>
@@ -86,9 +87,12 @@ static void event_deliver(struct vmci_event_msg *event_msg)
 {
        struct vmci_subscription *cur;
        struct list_head *subscriber_list;
+       u32 sanitized_event, max_vmci_event;
 
        rcu_read_lock();
-       subscriber_list = &subscriber_array[event_msg->event_data.event];
+       max_vmci_event = ARRAY_SIZE(subscriber_array);
+       sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event);
+       subscriber_list = &subscriber_array[sanitized_event];
        list_for_each_entry_rcu(cur, subscriber_list, node) {
                cur->callback(cur->id, &event_msg->event_data,
                              cur->callback_data);