From 785059df1ab6e8f37440c173271ea2a09ebeb8e6 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Wed, 30 Aug 2017 13:46:21 +0300 Subject: [PATCH 81/88] cw1200: prevent speculative execution CVE-2017-5753 (Spectre v1 Intel) Since the queue value in function cw1200_conf_tx() seems to be controllable by userspace and later on conditionally (upon bound check) used in WSM_TX_QUEUE_SET, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Signed-off-by: Andy Whitcroft --- drivers/net/wireless/st/cw1200/sta.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/st/cw1200/sta.c b/drivers/net/wireless/st/cw1200/sta.c index a52224836a2b..754fc43dc366 100644 --- a/drivers/net/wireless/st/cw1200/sta.c +++ b/drivers/net/wireless/st/cw1200/sta.c @@ -619,6 +619,7 @@ int cw1200_conf_tx(struct ieee80211_hw *dev, struct ieee80211_vif *vif, mutex_lock(&priv->conf_mutex); if (queue < dev->queues) { + osb(); old_uapsd_flags = le16_to_cpu(priv->uapsd_info.uapsd_flags); WSM_TX_QUEUE_SET(&priv->tx_queue_params, queue, 0, 0, 0); -- 2.15.1