From 5fea92e18248d450c16c897f95d295e8ecdea000 Mon Sep 17 00:00:00 2001 From: Jeetesh Burman Date: Thu, 15 Feb 2018 13:00:39 +0530 Subject: cryptodev: prevent speculative load related leak Data can be speculatively loaded from memory and stay in cache even when bound check fails. This can lead to unintended information disclosure via side-channel analysis. To mitigate this problem, insert speculation barrier. bug 2039126 CVE-2017-5753 Change-Id: Id85eb9c91932f358dd999b28dd53d7788b37ea04 Signed-off-by: David Gilhooley Reviewed-on: https://git-master.nvidia.com/r/1640356 Signed-off-by: James Huang Reviewed-on: https://git-master.nvidia.com/r/1650014 Signed-off-by: Jeetesh Burman (cherry picked from commit 25bd9436b11f41e23048c9515deae97900a46669) Reviewed-on: https://git-master.nvidia.com/r/1660780 Reviewed-by: Winnie Hsu Tested-by: Winnie Hsu --- drivers/misc/tegra-cryptodev.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drivers') diff --git a/drivers/misc/tegra-cryptodev.c b/drivers/misc/tegra-cryptodev.c index 4dc6ca63226d..2c0d3918100d 100644 --- a/drivers/misc/tegra-cryptodev.c +++ b/drivers/misc/tegra-cryptodev.c @@ -33,6 +33,7 @@ #include #include #include +#include #include "tegra-cryptodev.h" @@ -282,6 +283,8 @@ static int process_crypt_req(struct tegra_crypto_ctx *ctx, struct tegra_crypt_re const u8 *key = NULL; struct tegra_crypto_completion tcrypt_complete; + speculation_barrier(); + if (crypt_req->op & TEGRA_CRYPTO_ECB) { req = ablkcipher_request_alloc(ctx->ecb_tfm, GFP_KERNEL); tfm = ctx->ecb_tfm; @@ -930,6 +933,9 @@ rng_out: rsa_req.algo); return -EINVAL; } + + speculation_barrier(); + ret = tegra_crypt_rsa(ctx, &rsa_req); break; -- cgit v1.2.3