posix-timers: Protect posix clock array access against speculation

[pandora-kernel.git] / kernel / posix-timers.c

diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c
index 4a32f9c..3130973 100644 (file)
--- a/kernel/posix-timers.c
+++ b/kernel/posix-timers.c
@@ -47,6 +47,7 @@
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <linux/export.h>
+#include <linux/nospec.h>
 
 /*
  * Management arrays for POSIX timers.  Timers are kept in slab memory
@@ -520,13 +521,21 @@ static void release_posix_timer(struct k_itimer *tmr, int it_id_set)
 
 static struct k_clock *clockid_to_kclock(const clockid_t id)
 {
-       if (id < 0)
+       clockid_t idx = id;
+       struct k_clock *kc;
+
+       if (id < 0) {
                return (id & CLOCKFD_MASK) == CLOCKFD ?
                        &clock_posix_dynamic : &clock_posix_cpu;
+       }
+
+       if (id >= ARRAY_SIZE(posix_clocks))
+               return NULL;
 
-       if (id >= MAX_CLOCKS || !posix_clocks[id].clock_getres)
+       kc = &posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))];
+       if (!kc->clock_getres)
                return NULL;
-       return &posix_clocks[id];
+       return kc;
 }
 
 static int common_timer_create(struct k_itimer *new_timer)