From faa08e2706619837cfb4d7abf7162a3ae1b7cc5f Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 01:38:52 -0800 Subject: [PATCH] p54: prevent speculative execution Since the queue value in function p54_conf_tx() seems to be controllable by userspace and later on conditionally (upon bound check) used to resolve priv->qos_params, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Conflicts: patch refers to drivers/net/wireless/intersil/p54/main.c code base has drivers/net/wireless/p54/main.c Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- drivers/net/wireless/p54/main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/p54/main.c b/drivers/net/wireless/p54/main.c index e79674f73dc5..b79bb7238892 100644 --- a/drivers/net/wireless/p54/main.c +++ b/drivers/net/wireless/p54/main.c @@ -417,6 +417,7 @@ static int p54_conf_tx(struct ieee80211_hw *dev, mutex_lock(&priv->conf_mutex); if (queue < dev->queues) { + osb(); P54_SET_QUEUE(priv->qos_params[queue], params->aifs, params->cw_min, params->cw_max, params->txop); ret = p54_set_edcf(priv); -- 2.50.1