lkml.org 
[lkml]   [2018]   [May]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH 01/11] media: tm6000: fix potential Spectre variant 1
Em Wed, 16 May 2018 16:11:08 +0300
Dan Carpenter <dan.carpenter@oracle.com> escreveu:

> On Tue, May 15, 2018 at 04:00:33PM -0300, Mauro Carvalho Chehab wrote:
> > Yeah, that's the same I'm getting from media upstream.
> >
> > > drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line()
> > > warn: potential spectre issue 'pin->error_inj_args'
> >
> > This one seems a false positive, as the index var is u8 and the
> > array has 256 elements, as the userspace input from 'op' is
> > initialized with:
> >
> > u8 v;
> > u32 op;
> >
> > if (!kstrtou8(token, 0, &v))
> > op = v;
> >
>
> It's hard to silence this because Smatch stores the current user
> controlled range list, not what it was initially. I wrote all this code
> to detect bounds checking errors, so there wasn't any need to save the
> range list before the bounds check. Since "op" is a u32, I can't even
> go by the type of the index....

Yeah, I was thinking that is would be harder to clean this up on
smatch. I proposed a patch to the ML that simplifies the logic,
making easier for both humans and Smatch to better understand how
the arrays are indexed.

>
> > > drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write()
> > > warn: potential spectre issue 'ca->slot_info' (local cap)
> >
> > This one seems a real issue to me. Sent a patch for it.
> >
> > > drivers/media/dvb-core/dvb_net.c:252 handle_one_ule_extension() warn:
> > > potential spectre issue 'p->ule_next_hdr'
> >
> > I failed to see what's wrong here, or if this is exploited.
>
> Oh... Huh. This is a bug in smatch. That line looks like:
>
> p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN)));
>
> Smatch see the ntohs() and marks everything inside it as untrusted
> network data. I'll fix this.

Thanks!

Regards,
Mauro

\
 
 \ /
  Last update: 2018-05-16 15:37    [W:0.074 / U:0.072 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site