DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org C22A121480
Message-ID: <1537953785.28767.7.camel@sipsolutions.net>
Subject: Re: [PATCH 2/2] nl80211: Fix possible Spectre-v1 for CQM RSSI
 thresholds
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Masashi Honma <masashi.honma@gmail.com>
Cc:     linux-wireless@vger.kernel.org
Date:   Wed, 26 Sep 2018 11:23:05 +0200
In-Reply-To: <1537841701-3092-2-git-send-email-masashi.honma@gmail.com> (sfid-20180925_041523_318542_824D1A43)
References: <1537841701-3092-1-git-send-email-masashi.honma@gmail.com>
         <1537841701-3092-2-git-send-email-masashi.honma@gmail.com>
         (sfid-20180925_041523_318542_824D1A43)
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

On Tue, 2018-09-25 at 11:15 +0900, Masashi Honma wrote:
> Use array_index_nospec() to sanitize i with respect to speculation.

I applied the first patch in the seies, but I don't understand why this
patch should be necessary.

The value of i isn't controlled by the user, so it shouldn't need to be
sanitized?

The context was *just* missing, added by me:

        for (i = 0; i < n; i++)
>  		if (last < wdev->cqm_config->rssi_thresholds[i])
>  			break;

This loop determines i, and the user doesn't even control "last", but
even if they did, the possible values of i could only end up being in
the range 0..n-1, so no problems?

johannes