From 23f4ed3f85076f84a1ab0569c3600a0946b3812c Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 01:31:31 -0800 Subject: [PATCH] carl9170: prevent speculative execution Since the queue value in function carl9170_op_conf_tx() seems to be controllable by userspace and later on conditionally (upon bound check) used to resolve ar9170_qmap and following ar->edcf, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- drivers/net/wireless/ath/carl9170/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c index f1455a04cb62..152685575298 100644 --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -1389,6 +1389,7 @@ static int carl9170_op_conf_tx(struct ieee80211_hw *hw, mutex_lock(&ar->mutex); if (queue < ar->hw->queues) { + osb(); memcpy(&ar->edcf[ar9170_qmap[queue]], param, sizeof(*param)); ret = carl9170_set_qos(ar); } else { -- 2.50.1