Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a10e87f authored by Masashi Honma's avatar Masashi Honma Committed by Greg Kroah-Hartman
Browse files

nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds 



commit 4b2c5a14cd8005a900075f7dfec87473c6ee66fb upstream.

commit 1222a160 ("nl80211: Fix possible Spectre-v1 for CQM
RSSI thresholds") was incomplete and requires one more fix to
prevent accessing to rssi_thresholds[n] because user can control
rssi_thresholds[i] values to make i reach to n. For example,
rssi_thresholds = {-400, -300, -200, -100} when last is -34.

Cc: stable@vger.kernel.org
Fixes: 1222a160 ("nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds")
Reported-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarMasashi Honma <masashi.honma@gmail.com>
Link: https://lore.kernel.org/r/20190908005653.17433-1-masashi.honma@gmail.com


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 941431c4

net/wireless/nl80211.c

+3 −1
Original line number Diff line number Diff line
@@ -10270,9 +10270,11 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev, 
	hyst = wdev->cqm_config->rssi_hyst;

	n = wdev->cqm_config->n_rssi_thresholds;



	for (i = 0; i < n; i++)

	for (i = 0; i < n; i++) {

		i = array_index_nospec(i, n);

		if (last < wdev->cqm_config->rssi_thresholds[i])

			break;

	}



	low_index = i - 1;

	if (low_index >= 0) {