From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752585AbeEPNhL (ORCPT ); Wed, 16 May 2018 09:37:11 -0400 Received: from bombadil.infradead.org ([198.137.202.133]:44612 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752309AbeEPNhJ (ORCPT ); Wed, 16 May 2018 09:37:09 -0400 Date: Wed, 16 May 2018 10:36:56 -0300 From: Mauro Carvalho Chehab To: Dan Carpenter Cc: "Gustavo A. R. Silva" , Mauro Carvalho Chehab , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 01/11] media: tm6000: fix potential Spectre variant 1 Message-ID: <20180516103656.208043d4@vento.lan> In-Reply-To: <20180516131108.xcvsw6m4qrmqgykh@mwanda> References: <20180423152455.363d285c@vento.lan> <3ab9c4c9-0656-a08e-740e-394e2e509ae9@embeddedor.com> <20180423161742.66f939ba@vento.lan> <99e158c0-1273-2500-da9e-b5ab31cba889@embeddedor.com> <20180426204241.03a42996@vento.lan> <20180515085953.65bfa107@vento.lan> <20180515141655.idzuh2jfdkuu5grs@mwanda> <20180515160033.156f119c@vento.lan> <20180516131108.xcvsw6m4qrmqgykh@mwanda> X-Mailer: Claws Mail 3.16.0 (GTK+ 2.24.32; x86_64-redhat-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Em Wed, 16 May 2018 16:11:08 +0300 Dan Carpenter escreveu: > On Tue, May 15, 2018 at 04:00:33PM -0300, Mauro Carvalho Chehab wrote: > > Yeah, that's the same I'm getting from media upstream. > > > > > drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() > > > warn: potential spectre issue 'pin->error_inj_args' > > > > This one seems a false positive, as the index var is u8 and the > > array has 256 elements, as the userspace input from 'op' is > > initialized with: > > > > u8 v; > > u32 op; > > > > if (!kstrtou8(token, 0, &v)) > > op = v; > > > > It's hard to silence this because Smatch stores the current user > controlled range list, not what it was initially. I wrote all this code > to detect bounds checking errors, so there wasn't any need to save the > range list before the bounds check. Since "op" is a u32, I can't even > go by the type of the index.... Yeah, I was thinking that is would be harder to clean this up on smatch. I proposed a patch to the ML that simplifies the logic, making easier for both humans and Smatch to better understand how the arrays are indexed. > > > > drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write() > > > warn: potential spectre issue 'ca->slot_info' (local cap) > > > > This one seems a real issue to me. Sent a patch for it. > > > > > drivers/media/dvb-core/dvb_net.c:252 handle_one_ule_extension() warn: > > > potential spectre issue 'p->ule_next_hdr' > > > > I failed to see what's wrong here, or if this is exploited. > > Oh... Huh. This is a bug in smatch. That line looks like: > > p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN))); > > Smatch see the ntohs() and marks everything inside it as untrusted > network data. I'll fix this. Thanks! Regards, Mauro