DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 417CD21536
Subject: Re: [PATCH 2/2] nl80211: Fix possible Spectre-v1 for CQM RSSI
 thresholds
To:     Johannes Berg <johannes@sipsolutions.net>
Cc:     linux-wireless@vger.kernel.org
References: <1537841701-3092-1-git-send-email-masashi.honma@gmail.com>
 <1537841701-3092-2-git-send-email-masashi.honma@gmail.com>
 <1537953785.28767.7.camel@sipsolutions.net>
From:   Masashi Honma <masashi.honma@gmail.com>
Message-ID: <26b99a9d-85c1-ea9a-cb9e-0dc7bf9eb467@gmail.com>
Date:   Thu, 27 Sep 2018 07:26:48 +0900
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <1537953785.28767.7.camel@sipsolutions.net>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

On 2018/09/26 18:23, Johannes Berg wrote:> I applied the first patch in 
the seies, but I don't understand why this
> patch should be necessary.
> 
> The value of i isn't controlled by the user, so it shouldn't need to be
> sanitized?
> 
> The context was *just* missing, added by me:
> 
>          for (i = 0; i < n; i++)
>>   		if (last < wdev->cqm_config->rssi_thresholds[i])
>>   			break;
> 
> This loop determines i, and the user doesn't even control "last", but
> even if they did, the possible values of i could only end up being in
> the range 0..n-1, so no problems?

The variable i could be n after the loop when this condition is not 
satisfied for all rssi_thresholds[i].

 >>   		if (last < wdev->cqm_config->rssi_thresholds[i])
 >>   			break;

And user could control rssi_thresholds[i] by using 
NL80211_ATTR_CQM_RSSI_THOLD.

For example, I could set 4 rssi_thresholds -400, -300, -200, -100.
And then last is -34. I could get i = n = 4 after the loop.

Regards,
Masashi Honma.