Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1222a160 authored by Masashi Honma's avatar Masashi Honma Committed by Johannes Berg
Browse files

nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds 



Use array_index_nospec() to sanitize i with respect to speculation.

Note that the user doesn't control i directly, but can make it out
of bounds by not finding a threshold in the array.

Signed-off-by: default avatarMasashi Honma <masashi.honma@gmail.com>
[add note about user control, as explained by Masashi]
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 28ef8b49

net/wireless/nl80211.c

+14 −5
Original line number Diff line number Diff line
@@ -10231,7 +10231,7 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 
	struct wireless_dev *wdev = dev->ieee80211_ptr;

	s32 last, low, high;

	u32 hyst;

	int i, n;

	int i, n, low_index;

	int err;



	/* RSSI reporting disabled? */
@@ -10268,10 +10268,19 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 
		if (last < wdev->cqm_config->rssi_thresholds[i])

			break;



	low = i > 0 ?

		(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;

	high = i < n ?

		(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;

	low_index = i - 1;

	if (low_index >= 0) {

		low_index = array_index_nospec(low_index, n);

		low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;

	} else {

		low = S32_MIN;

	}

	if (i < n) {

		i = array_index_nospec(i, n);

		high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;

	} else {

		high = S32_MAX;

	}



	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);

}