Received-SPF: pass (google.com: best guess record for domain of linux-wireless-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
From:   Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
To:     "linux-wireless@vger.kernel.org" <linux-wireless@vger.kernel.org>
CC:     Igor Mitsyanko <igor.mitsyanko.os@quantenna.com>,
        Mikhail Karpenko <mkarpenko@quantenna.com>,
        Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Subject: [PATCH 10/10] qtnfmac: fix potential Spectre vulnerabilities
Thread-Topic: [PATCH 10/10] qtnfmac: fix potential Spectre vulnerabilities
Thread-Index: AQHV1P8ZYE5Gmf0CBk6P16moh5B8sw==
Date:   Mon, 27 Jan 2020 10:46:58 +0000
Message-ID: <20200127104634.7248-11-sergey.matyukevich.os@quantenna.com>
References: <20200127104634.7248-1-sergey.matyukevich.os@quantenna.com>
In-Reply-To: <20200127104634.7248-1-sergey.matyukevich.os@quantenna.com>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-messagesentrepresentingtype: 1
x-mailer: git-send-email 2.11.0
x-originating-ip: [195.182.157.78]
x-ms-publictraffictype: Email
x-ms-office365-filtering-correlation-id: b3172e1e-3db7-476b-b0c3-08d7a3163ba0
x-ms-traffictypediagnostic: SN6PR05MB5391:|SN6PR05MB4464:
x-ms-exchange-transport-forked: True
x-microsoft-antispam-prvs: <SN6PR05MB5391395BFB6E5FC8BB9D42D7A30B0@SN6PR05MB5391.namprd05.prod.outlook.com>
x-moderation-data: 1/27/2020 10:48:19 AM
x-ms-oob-tlc-oobclassifiers: OLM:117;
x-forefront-prvs: 02951C14DC
x-forefront-antispam-report: SFV:NSPM;SFS:(10009020)(396003)(39840400004)(346002)(366004)(376002)(136003)(189003)(199004)(316002)(81156014)(107886003)(4326008)(5660300002)(1076003)(81166006)(8936002)(8676002)(54906003)(2906002)(6916009)(36756003)(6486002)(478600001)(71200400001)(7696005)(52116002)(86362001)(103116003)(186003)(16526019)(26005)(64756008)(66446008)(956004)(2616005)(66946007)(66476007)(66556008);DIR:OUT;SFP:1101;SCL:1;SRVR:SN6PR05MB4464;H:SN6PR05MB4765.namprd05.prod.outlook.com;FPR:;SPF:None;LANG:en;PTR:InfoNoRecords;MX:1;A:1;
received-spf: None (protection.outlook.com: quantenna.com does not designate
 permitted sender hosts)
x-ms-exchange-senderadcheck: 1
x-microsoft-antispam: BCL:0;
x-microsoft-antispam-message-info: i7SUzcADkscy576swfMXUfXY3I5kUeHLXAtnI98UP7XnJde0hg+JabERPv8ot/0SopoUj/sjGQc7MgRz0wjj+xyzGsn8j3/K1nRTLZVdujT5UdhRy+ybl6MBb4irTs/Uqyt2419JXb5zjTRA9dQQIAA/Rlbz2wBRw3LMOz6OwgpxRZDy/THo9asTNOyVoWAED5X0DcmpnJ3UweUyt0wN2smZJoa/Dp/ATYO1cojujPOuq1nymh74biezLl4jIdIZ3PnMYdhGTTJYcrs9nNZpuTIx495LW5JmzkgJd+De9t7SsUkfrbcB/ni7rwhsIaAi6i3UOifEhq8njQ33KzQH1mjevdBY6fW4MpGI5IvdCO9KIbFL0jKndEomBaO/6dxru4B0Yqu7Y5sjG6gMaIgLDrbVJCqwVbMY/rf04FnhP+tO4TQlhsj6jas+XQg3TOZ0
x-ms-exchange-antispam-messagedata: hzos2pBCUuE0+3gryGkQ7LupkGuFoQGaa/G3vs+YCOYnutW5pwhSR8zCOrA6XYHDyGGCUBssT/Nw2/y48lfwVuwXBmUpRxNSelXgZaiEnddTrcbBa1r+bwDzmB7eIfXFw0u064rFoYqfKPYLfiPFeQ==
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: quantenna.com
X-MS-Exchange-CrossTenant-Network-Message-Id: b3172e1e-3db7-476b-b0c3-08d7a3163ba0
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: a355dbce-62b4-4789-9446-c1d5582180ff
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: zoim+a/Wx0hSUn4JukEqhyDbHcSalJoo4z9cIH+yr+WKiEBE4XZTxQaGwnSJvAsRS0yY/aYwGZsOIs0GirAVnweVxppWAuLpAe3vjIW6rCo/d4BUOeT9O8LtHpysCZk3c1Kd4TolsaesnAzwXOGunRygMyDzQuA2lr3oWQYbqxy6YTCRvsD4D3sAbSkBztPVwvXqTTr84cm2rZHH9E+I9pGIUWHbWFq9DL+wWhj/9Dk=
X-MS-Exchange-CrossTenant-originalarrivaltime: 27 Jan 2020 10:48:21.7088
 (UTC)
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR05MB4464
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.138,18.0.572
 definitions=2020-01-27_02:2020-01-24,2020-01-27 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 clxscore=1015 phishscore=0 adultscore=0
 spamscore=0 mlxscore=0 impostorscore=0 lowpriorityscore=0 malwarescore=0
 suspectscore=0 bulkscore=0 mlxlogscore=999 priorityscore=1501
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-1911200001
 definitions=main-2001270091
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk
List-ID: <linux-wireless.vger.kernel.org>
X-Mailing-List: linux-wireless@vger.kernel.org

Fix potential Spectre vulnerabilities and other warnings
reported by smatch:

drivers/net/wireless/quantenna/qtnfmac/core.c:49 qtnf_core_get_mac() warn: =
potential spectre issue 'bus->mac' [r] (local cap)
drivers/net/wireless/quantenna/qtnfmac/core.c:51 qtnf_core_get_mac() warn: =
possible spectre second half.  'mac'
drivers/net/wireless/quantenna/qtnfmac/event.c:671 qtnf_event_parse() warn:=
 potential spectre issue 'mac->iflist' [r] (local cap)
drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c:912 qtnf_pcie_skb_=
send() warn: variable dereferenced before check 'skb' (see line 881)

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
---
 drivers/net/wireless/quantenna/qtnfmac/core.c            | 4 +++-
 drivers/net/wireless/quantenna/qtnfmac/event.c           | 9 ++++++---
 drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c | 2 +-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/quantenna/qtnfmac/core.c b/drivers/net/wi=
reless/quantenna/qtnfmac/core.c
index 74c9aa297ec9..9e666fac8b5f 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/core.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/core.c
@@ -4,6 +4,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/if_ether.h>
+#include <linux/nospec.h>
=20
 #include "core.h"
 #include "bus.h"
@@ -41,11 +42,12 @@ struct qtnf_wmac *qtnf_core_get_mac(const struct qtnf_b=
us *bus, u8 macid)
 {
 	struct qtnf_wmac *mac =3D NULL;
=20
-	if (unlikely(macid >=3D QTNF_MAX_MAC)) {
+	if (macid >=3D QTNF_MAX_MAC) {
 		pr_err("invalid MAC index %u\n", macid);
 		return NULL;
 	}
=20
+	macid =3D array_index_nospec(macid, QTNF_MAX_MAC);
 	mac =3D bus->mac[macid];
=20
 	if (unlikely(!mac)) {
diff --git a/drivers/net/wireless/quantenna/qtnfmac/event.c b/drivers/net/w=
ireless/quantenna/qtnfmac/event.c
index 9d3849488fc7..7e408b5c5549 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/event.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/event.c
@@ -4,6 +4,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/nospec.h>
=20
 #include "cfg80211.h"
 #include "core.h"
@@ -632,18 +633,20 @@ static int qtnf_event_parse(struct qtnf_wmac *mac,
 	int ret =3D -1;
 	u16 event_id;
 	u16 event_len;
+	u8 vifid;
=20
 	event =3D (const struct qlink_event *)event_skb->data;
 	event_id =3D le16_to_cpu(event->event_id);
 	event_len =3D le16_to_cpu(event->mhdr.len);
=20
-	if (likely(event->vifid < QTNF_MAX_INTF)) {
-		vif =3D &mac->iflist[event->vifid];
-	} else {
+	if (event->vifid >=3D QTNF_MAX_INTF) {
 		pr_err("invalid vif(%u)\n", event->vifid);
 		return -EINVAL;
 	}
=20
+	vifid =3D array_index_nospec(event->vifid, QTNF_MAX_INTF);
+	vif =3D &mac->iflist[vifid];
+
 	switch (event_id) {
 	case QLINK_EVENT_STA_ASSOCIATED:
 		ret =3D qtnf_event_handle_sta_assoc(mac, vif, (const void *)event,
diff --git a/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c b/dri=
vers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
index 8e0d8018208a..dbb241106d8a 100644
--- a/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
+++ b/drivers/net/wireless/quantenna/qtnfmac/pcie/pearl_pcie.c
@@ -593,7 +593,7 @@ static int qtnf_pcie_skb_send(struct qtnf_bus *bus, str=
uct sk_buff *skb)
 	priv->tx_bd_w_index =3D i;
=20
 tx_done:
-	if (ret && skb) {
+	if (ret) {
 		pr_err_ratelimited("drop skb\n");
 		if (skb->dev)
 			skb->dev->stats.tx_dropped++;
--=20
2.11.0