leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds

Browse Source 
Use array_index_nospec() to sanitize i with respect to speculation.

Note that the user doesn't control i directly, but can make it out
of bounds by not finding a threshold in the array.

Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
[add note about user control, as explained by Masashi]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Masashi Honma 2018-09-25 11:15:01 +09:00 committed by Johannes Berg
parent 28ef8b49a3
commit 1222a16014
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
net/wireless/nl80211.c
View File

@ -10231,7 +10231,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
struct wireless_dev *wdev = dev->ieee80211_ptr; struct wireless_dev *wdev = dev->ieee80211_ptr;
s32 last, low, high; s32 last, low, high;
u32 hyst; u32 hyst;
int i, n; int i, n, low_index;
int err; int err;
/* RSSI reporting disabled? */ /* RSSI reporting disabled? */
@ -10268,10 +10268,19 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
if (last < wdev->cqm_config->rssi_thresholds[i]) if (last < wdev->cqm_config->rssi_thresholds[i])
break; break;
low = i > 0 ? low_index = i - 1;
(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN; if (low_index >= 0) {
high = i < n ? low_index = array_index_nospec(low_index, n);
(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX; low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
} else {
low = S32_MIN;
}
if (i < n) {
i = array_index_nospec(i, n);
high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
} else {
high = S32_MAX;
}
return rdev_set_cqm_rssi_range_config(rdev, dev, low, high); return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
} }