Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sat, 7 Sep 2019 16:02:34 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     masashi.honma@gmail.com
Cc:     linux-wireless@vger.kernel.org
Subject: [bug report] nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds
Message-ID: <20190907130234.GA32057@mwanda>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

Hello Masashi Honma,

The patch 1222a1601488: "nl80211: Fix possible Spectre-v1 for CQM
RSSI thresholds" from Sep 25, 2018, leads to the following static
checker warning:

	net/wireless/nl80211.c:10820 cfg80211_cqm_rssi_update()
	warn: disabling speculation after use: 'i'

net/wireless/nl80211.c
 10804          last = wdev->cqm_config->last_rssi_event_value;
 10805          hyst = wdev->cqm_config->rssi_hyst;
 10806          n = wdev->cqm_config->n_rssi_thresholds;
 10807  
 10808          for (i = 0; i < n; i++)
 10809                  if (last < wdev->cqm_config->rssi_thresholds[i])
                                                     ^^^^^^^^^^^^^^^^^^
We've already used "i" as an index.

 10810                          break;
 10811  
 10812          low_index = i - 1;
 10813          if (low_index >= 0) {
 10814                  low_index = array_index_nospec(low_index, n);
                                    ^^^^^^^^^^^^^^^^^^

 10815                  low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
 10816          } else {
 10817                  low = S32_MIN;
 10818          }
 10819          if (i < n) {
 10820                  i = array_index_nospec(i, n);
                            ^^^^^^^^^^^^^^^^^^
So this seems like closing the barn door after the horses have left.

 10821                  high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
 10822          } else {
 10823                  high = S32_MAX;
 10824          }

regards,
dan carpenter