summaryrefslogtreecommitdiffstats
path: root/drivers/staging/wfx
diff options
context:
space:
mode:
authorJérôme Pouiller <jerome.pouiller@silabs.com>2019-10-11 16:47:51 +0000
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2019-10-14 15:37:19 +0200
commit88d0facf186c6c652c2203536fecd77089b43a4e (patch)
tree203d0e9852f5dabf88b923c961deb6625a5d559c /drivers/staging/wfx
parent44288f1101feba11beef9536b176dadae420d874 (diff)
downloadlinux-stable-88d0facf186c6c652c2203536fecd77089b43a4e.tar.gz
linux-stable-88d0facf186c6c652c2203536fecd77089b43a4e.tar.bz2
linux-stable-88d0facf186c6c652c2203536fecd77089b43a4e.zip
staging: wfx: fix potential vulnerability to spectre
array_index_nospec() should be applied after a bound check. Fixes: 9bca45f3d692 ("staging: wfx: allow to send 802.11 frames") Reported-by: kbuild test robot <lkp@intel.com> Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com> Link: https://lore.kernel.org/r/20191011164746.2518-1-Jerome.Pouiller@silabs.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/wfx')
-rw-r--r--drivers/staging/wfx/wfx.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/staging/wfx/wfx.h b/drivers/staging/wfx/wfx.h
index 489836837b0a..d678b5a08873 100644
--- a/drivers/staging/wfx/wfx.h
+++ b/drivers/staging/wfx/wfx.h
@@ -13,6 +13,7 @@
#include <linux/completion.h>
#include <linux/workqueue.h>
#include <linux/mutex.h>
+#include <linux/nospec.h>
#include <net/mac80211.h>
#include "bh.h"
@@ -138,6 +139,7 @@ static inline struct wfx_vif *wdev_to_wvif(struct wfx_dev *wdev, int vif_id)
dev_dbg(wdev->dev, "requesting non-existent vif: %d\n", vif_id);
return NULL;
}
+ vif_id = array_index_nospec(vif_id, ARRAY_SIZE(wdev->vif));
if (!wdev->vif[vif_id]) {
dev_dbg(wdev->dev, "requesting non-allocated vif: %d\n", vif_id);
return NULL;