Commit 5a20a093 authored by Ioana Radulescu's avatar Ioana Radulescu Committed by David S. Miller

dpaa2-eth: Fix potential spectre issue

Smatch reports a potential spectre vulnerability in the dpaa2-eth
driver, where the value of rxnfc->fs.location (which is provided
from user-space) is used as index in an array.

Add a call to array_index_nospec() to sanitize the access.
Signed-off-by: default avatarIoana Radulescu <ruxandra.radulescu@nxp.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 33403121
...@@ -4,6 +4,7 @@ ...@@ -4,6 +4,7 @@
*/ */
#include <linux/net_tstamp.h> #include <linux/net_tstamp.h>
#include <linux/nospec.h>
#include "dpni.h" /* DPNI_LINK_OPT_* */ #include "dpni.h" /* DPNI_LINK_OPT_* */
#include "dpaa2-eth.h" #include "dpaa2-eth.h"
...@@ -648,6 +649,8 @@ static int dpaa2_eth_get_rxnfc(struct net_device *net_dev, ...@@ -648,6 +649,8 @@ static int dpaa2_eth_get_rxnfc(struct net_device *net_dev,
case ETHTOOL_GRXCLSRULE: case ETHTOOL_GRXCLSRULE:
if (rxnfc->fs.location >= max_rules) if (rxnfc->fs.location >= max_rules)
return -EINVAL; return -EINVAL;
rxnfc->fs.location = array_index_nospec(rxnfc->fs.location,
max_rules);
if (!priv->cls_rules[rxnfc->fs.location].in_use) if (!priv->cls_rules[rxnfc->fs.location].in_use)
return -EINVAL; return -EINVAL;
rxnfc->fs = priv->cls_rules[rxnfc->fs.location].fs; rxnfc->fs = priv->cls_rules[rxnfc->fs.location].fs;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment