From 529e50a4c9b9579914bc0276b7d63b5f4416e496 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 01:50:27 -0800 Subject: [PATCH] cw1200: prevent speculative execution Since the queue value in function cw1200_conf_tx() seems to be controllable by userspace and later on conditionally (upon bound check) used in WSM_TX_QUEUE_SET, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Conflicts: patch refers to drivers/net/wireless/st/cw1200/sta.c code base has drivers/net/wireless/cw1200/sta.c Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- drivers/net/wireless/cw1200/sta.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c index b0f65fa094287..d1626f56c6eea 100644 --- a/drivers/net/wireless/cw1200/sta.c +++ b/drivers/net/wireless/cw1200/sta.c @@ -623,6 +623,7 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif, mutex_lock(&priv->conf_mutex); if (queue < dev->queues) { + osb(); old_uapsd_flags = le16_to_cpu(priv->uapsd_info.uapsd_flags); WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0); -- 2.50.1