Commit 1222a160 authored by Masashi Honma's avatar Masashi Honma Committed by Johannes Berg

nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds

Use array_index_nospec() to sanitize i with respect to speculation.

Note that the user doesn't control i directly, but can make it out
of bounds by not finding a threshold in the array.
Signed-off-by: default avatarMasashi Honma <masashi.honma@gmail.com>
[add note about user control, as explained by Masashi]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 28ef8b49
......@@ -10231,7 +10231,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
struct wireless_dev *wdev = dev->ieee80211_ptr;
s32 last, low, high;
u32 hyst;
int i, n;
int i, n, low_index;
int err;
/* RSSI reporting disabled? */
......@@ -10268,10 +10268,19 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
if (last < wdev->cqm_config->rssi_thresholds[i])
break;
low = i > 0 ?
(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
high = i < n ?
(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
low_index = i - 1;
if (low_index >= 0) {
low_index = array_index_nospec(low_index, n);
low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
} else {
low = S32_MIN;
}
if (i < n) {
i = array_index_nospec(i, n);
high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
} else {
high = S32_MAX;
}
return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
}
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment