diff options
| author | Adam Guerin <adam.guerin@intel.com> | 2021-01-04 18:21:57 +0100 |
|---|---|---|
| committer | Herbert Xu <herbert@gondor.apana.org.au> | 2021-01-14 07:10:26 +0100 |
| commit | 1aaae055d48e8f9c841dcce07d90fa5f8b6acf2e (patch) | |
| tree | 673aa5e717ccd4d44e517e8f06e25c49f0534136 /drivers/crypto | |
| parent | crypto: qat - configure arbiter mapping based on engines enabled (diff) | |
| download | linux-1aaae055d48e8f9c841dcce07d90fa5f8b6acf2e.tar.xz linux-1aaae055d48e8f9c841dcce07d90fa5f8b6acf2e.zip | |
crypto: qat - fix potential spectre issue
Sanitize ring_num value coming from configuration (and potentially
from user space) before it is used as index in the banks array.
This issue was detected by smatch:
drivers/crypto/qat/qat_common/adf_transport.c:233 adf_create_ring() warn: potential spectre issue 'bank->rings' [r] (local cap)
Signed-off-by: Adam Guerin <adam.guerin@intel.com>
Reviewed-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'drivers/crypto')
| -rw-r--r-- | drivers/crypto/qat/qat_common/adf_transport.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/crypto/qat/qat_common/adf_transport.c b/drivers/crypto/qat/qat_common/adf_transport.c index 5a7030acdc33..888c1e047295 100644 --- a/drivers/crypto/qat/qat_common/adf_transport.c +++ b/drivers/crypto/qat/qat_common/adf_transport.c @@ -1,6 +1,7 @@ // SPDX-License-Identifier: (BSD-3-Clause OR GPL-2.0-only) /* Copyright(c) 2014 - 2020 Intel Corporation */ #include <linux/delay.h> +#include <linux/nospec.h> #include "adf_accel_devices.h" #include "adf_transport_internal.h" #include "adf_transport_access_macros.h" @@ -246,6 +247,7 @@ int adf_create_ring(struct adf_accel_dev *accel_dev, const char *section, return -EFAULT; } + ring_num = array_index_nospec(ring_num, num_rings_per_bank); bank = &transport_data->banks[bank_num]; if (adf_reserve_ring(bank, ring_num)) { dev_err(&GET_DEV(accel_dev), "Ring %d, %s already exists.\n", |