diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-07-01 17:13:56 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-07-01 17:13:56 +0000 |
| commit | 511e4ecd3211371086a9698ce4042700957cee33 (patch) | |
| tree | 7e4c8dbd3f81844f362f480dd8c9244afd9e31dc /drivers/misc/vmw_vmci/vmci_event.c | |
| parent | Adding debian version 6.9.2-1~exp1. (diff) | |
| download | linux-511e4ecd3211371086a9698ce4042700957cee33.tar.xz linux-511e4ecd3211371086a9698ce4042700957cee33.zip | |
Merging upstream version 6.9.7.
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'drivers/misc/vmw_vmci/vmci_event.c')
| -rw-r--r-- | drivers/misc/vmw_vmci/vmci_event.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/misc/vmw_vmci/vmci_event.c b/drivers/misc/vmw_vmci/vmci_event.c index 5d7ac07623..9a41ab6537 100644 --- a/drivers/misc/vmw_vmci/vmci_event.c +++ b/drivers/misc/vmw_vmci/vmci_event.c @@ -9,6 +9,7 @@ #include <linux/vmw_vmci_api.h> #include <linux/list.h> #include <linux/module.h> +#include <linux/nospec.h> #include <linux/sched.h> #include <linux/slab.h> #include <linux/rculist.h> @@ -86,9 +87,12 @@ static void event_deliver(struct vmci_event_msg *event_msg) { struct vmci_subscription *cur; struct list_head *subscriber_list; + u32 sanitized_event, max_vmci_event; rcu_read_lock(); - subscriber_list = &subscriber_array[event_msg->event_data.event]; + max_vmci_event = ARRAY_SIZE(subscriber_array); + sanitized_event = array_index_nospec(event_msg->event_data.event, max_vmci_event); + subscriber_list = &subscriber_array[sanitized_event]; list_for_each_entry_rcu(cur, subscriber_list, node) { cur->callback(cur->id, &event_msg->event_data, cur->callback_data); |