mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-14 15:54:15 +08:00
nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
Use array_index_nospec() to sanitize i with respect to speculation. Note that the user doesn't control i directly, but can make it out of bounds by not finding a threshold in the array. Signed-off-by: Masashi Honma <masashi.honma@gmail.com> [add note about user control, as explained by Masashi] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
parent
28ef8b49a3
commit
1222a16014
@ -10231,7 +10231,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
|
||||
struct wireless_dev *wdev = dev->ieee80211_ptr;
|
||||
s32 last, low, high;
|
||||
u32 hyst;
|
||||
int i, n;
|
||||
int i, n, low_index;
|
||||
int err;
|
||||
|
||||
/* RSSI reporting disabled? */
|
||||
@ -10268,10 +10268,19 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
|
||||
if (last < wdev->cqm_config->rssi_thresholds[i])
|
||||
break;
|
||||
|
||||
low = i > 0 ?
|
||||
(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
|
||||
high = i < n ?
|
||||
(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
|
||||
low_index = i - 1;
|
||||
if (low_index >= 0) {
|
||||
low_index = array_index_nospec(low_index, n);
|
||||
low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
|
||||
} else {
|
||||
low = S32_MIN;
|
||||
}
|
||||
if (i < n) {
|
||||
i = array_index_nospec(i, n);
|
||||
high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
|
||||
} else {
|
||||
high = S32_MAX;
|
||||
}
|
||||
|
||||
return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user