linux/net/nfc
Gustavo A. R. Silva a95386f039 nfc: af_nfc: Fix Spectre v1 vulnerability
proto is indirectly controlled by user-space, hence leading to
a potential exploitation of the Spectre variant 1 vulnerability.

This issue was detected with the help of Smatch:

net/nfc/af_nfc.c:42 nfc_sock_create() warn: potential spectre issue 'proto_tab' [w] (local cap)

Fix this by sanitizing proto before using it to index proto_tab.

Notice that given that speculation windows are large, the policy is
to kill the speculation on the first load and not worry if it can be
completed with a dependent load/store [1].

[1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2

Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2018-12-22 15:09:25 -08:00
..
hci NFC: Fix possible memory corruption when handling SHDLC I-Frame commands 2018-09-18 19:55:01 -07:00
nci Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2018-10-24 14:43:41 +01:00
af_nfc.c nfc: af_nfc: Fix Spectre v1 vulnerability 2018-12-22 15:09:25 -08:00
core.c NFC: Convert timers to use timer_setup() 2017-11-06 01:12:10 +01:00
digital_core.c NFC: digital: Abort cmd when deactivating target 2017-11-10 00:03:39 +01:00
digital_dep.c NFC: digital: NFC-DEP Target WT(nfcdep,max) is now 14 2017-06-23 00:19:59 +02:00
digital_technology.c NFC: digital: NFC-A SEL_RES must be one byte 2017-06-23 00:19:59 +02:00
digital.h
Kconfig
llcp_commands.c net/nfc: Avoid stalls when nfc_alloc_send_skb() returned NULL. 2018-07-18 10:51:45 -07:00
llcp_core.c NFC: Convert timers to use timer_setup() 2017-11-06 01:12:10 +01:00
llcp_sock.c Revert "net: simplify sock_poll_wait" 2018-10-23 10:57:06 -07:00
llcp.h
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
netlink.c net: remove unnecessary genlmsg_cancel() calls 2018-05-29 09:53:38 -04:00
nfc.h nfc: netlink: HCI event connectivity implementation 2015-12-29 19:06:20 +01:00
rawsock.c Revert changes to convert to ->poll_mask() and aio IOCB_CMD_POLL 2018-06-28 10:40:47 -07:00