lkml.org 
[lkml]   [2018]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    SubjectRe: [PATCH 09/18] p54: prevent bounds-check bypass via speculative execution
    From
    Date
    On 1/6/2018 4:10 AM, Dan Williams wrote:

    > Static analysis reports that 'queue' may be a user controlled value that
    > is used as a data dependency to read from the 'priv->qos_params' array.
    > In order to avoid potential leaks of kernel memory values, block
    > speculative execution of the instruction stream that could issue reads
    > based on an invalid result of 'priv->qos_params[queue]'.
    >
    > Based on an original patch by Elena Reshetova.
    >
    > Cc: Christian Lamparter <chunkeey@googlemail.com>
    > Cc: Kalle Valo <kvalo@codeaurora.org>
    > Cc: linux-wireless@vger.kernel.org
    > Cc: netdev@vger.kernel.org
    > Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    > Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    > ---
    > drivers/net/wireless/intersil/p54/main.c | 8 +++++---
    > 1 file changed, 5 insertions(+), 3 deletions(-)
    >
    > diff --git a/drivers/net/wireless/intersil/p54/main.c b/drivers/net/wireless/intersil/p54/main.c
    > index ab6d39e12069..85c9cbee35fc 100644
    > --- a/drivers/net/wireless/intersil/p54/main.c
    > +++ b/drivers/net/wireless/intersil/p54/main.c
    [...]
    > @@ -411,12 +412,13 @@ static int p54_conf_tx(struct ieee80211_hw *dev,
    > const struct ieee80211_tx_queue_params *params)
    > {
    > struct p54_common *priv = dev->priv;
    > + struct p54_edcf_queue_param *p54_q;
    > int ret;
    >
    > mutex_lock(&priv->conf_mutex);
    > - if (queue < dev->queues) {
    > - P54_SET_QUEUE(priv->qos_params[queue], params->aifs,
    > - params->cw_min, params->cw_max, params->txop);
    > + if ((p54_q = nospec_array_ptr(priv->qos_params, queue, dev->queues))) {

    Same complaint here...

    > + P54_SET_QUEUE(p54_q[0], params->aifs, params->cw_min,
    > + params->cw_max, params->txop);
    > ret = p54_set_edcf(priv);
    > } else
    > ret = -EINVAL;
    >

    MBR, Sergei

    \
     
     \ /
      Last update: 2018-01-06 11:03    [W:4.133 / U:0.228 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site