lkml.org 
[lkml]   [2018]   [Jan]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH 08/18] carl9170: prevent bounds-check bypass via speculative execution
    From
    Date
    Static analysis reports that 'queue' may be a user controlled value that
    is used as a data dependency to read from the 'ar9170_qmap' array. In
    order to avoid potential leaks of kernel memory values, block
    speculative execution of the instruction stream that could issue reads
    based on an invalid result of 'ar9170_qmap[queue]'. In this case the
    value of 'ar9170_qmap[queue]' is immediately reused as an index to the
    'ar->edcf' array.

    Based on an original patch by Elena Reshetova.

    Cc: Christian Lamparter <chunkeey@googlemail.com>
    Cc: Kalle Valo <kvalo@codeaurora.org>
    Cc: linux-wireless@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
    Signed-off-by: Dan Williams <dan.j.williams@intel.com>
    ---
    drivers/net/wireless/ath/carl9170/main.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c
    index 988c8857d78c..0ff34cbe2b62 100644
    --- a/drivers/net/wireless/ath/carl9170/main.c
    +++ b/drivers/net/wireless/ath/carl9170/main.c
    @@ -41,6 +41,7 @@
    #include <linux/module.h>
    #include <linux/etherdevice.h>
    #include <linux/random.h>
    +#include <linux/compiler.h>
    #include <net/mac80211.h>
    #include <net/cfg80211.h>
    #include "hw.h"
    @@ -1384,11 +1385,12 @@ static int carl9170_op_conf_tx(struct ieee80211_hw *hw,
    const struct ieee80211_tx_queue_params *param)
    {
    struct ar9170 *ar = hw->priv;
    + const u8 *elem;
    int ret;

    mutex_lock(&ar->mutex);
    - if (queue < ar->hw->queues) {
    - memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param));
    + if ((elem = nospec_array_ptr(ar9170_qmap, queue, ar->hw->queues))) {
    + memcpy(&ar->edcf[*elem], param, sizeof(*param));
    ret = carl9170_set_qos(ar);
    } else {
    ret = -EINVAL;
    \
     
     \ /
      Last update: 2018-01-06 02:23    [W:4.032 / U:0.056 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site