From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
To: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH 01/11] media: tm6000: fix potential Spectre variant 1
Date: Thu, 26 Apr 2018 16:41:56 -0500 [thread overview]
Message-ID: <99e158c0-1273-2500-da9e-b5ab31cba889@embeddedor.com> (raw)
In-Reply-To: <20180423161742.66f939ba@vento.lan>
Hi Mauro,
On 04/23/2018 02:17 PM, Mauro Carvalho Chehab wrote:
> Em Mon, 23 Apr 2018 14:11:02 -0500
>
> Thanks, I 'll mark this series as rejected at patchwork.linuxtv.org.
> Please feel free to resubmit any patch if they represent a real
> threat, adding a corresponding description about the threat scenario
> at the body of the e-mail.
>
>> Sorry for the noise and thanks for the feedback.
>
> Anytime.
>
I noticed you changed the status of this series from rejected to new.
Also, there are other similar issues in media/pci/
I can write proper patches for all of them if you agree those are not
False Positives:
diff --git a/drivers/media/pci/cx18/cx18-ioctl.c
b/drivers/media/pci/cx18/cx18-ioctl.c
index 80b902b..63f4388 100644
--- a/drivers/media/pci/cx18/cx18-ioctl.c
+++ b/drivers/media/pci/cx18/cx18-ioctl.c
@@ -36,6 +36,8 @@
#include <media/tveeprom.h>
#include <media/v4l2-event.h>
+#include <linux/nospec.h>
+
u16 cx18_service2vbi(int type)
{
switch (type) {
@@ -488,8 +490,9 @@ static int cx18_enum_fmt_vid_cap(struct file *file,
void *fh,
},
};
- if (fmt->index > ARRAY_SIZE(formats) - 1)
+ if (fmt->index >= ARRAY_SIZE(formats))
return -EINVAL;
+ fmt->index = array_index_nospec(fmt->index, ARRAY_SIZE(formats));
*fmt = formats[fmt->index];
return 0;
}
diff --git a/drivers/media/pci/saa7134/saa7134-video.c
b/drivers/media/pci/saa7134/saa7134-video.c
index 1a50ec9..d93cf09 100644
--- a/drivers/media/pci/saa7134/saa7134-video.c
+++ b/drivers/media/pci/saa7134/saa7134-video.c
@@ -30,6 +30,8 @@
#include <media/v4l2-event.h>
#include <media/i2c/saa6588.h>
+#include <linux/nospec.h>
+
/* ------------------------------------------------------------------ */
unsigned int video_debug;
@@ -1819,6 +1821,8 @@ static int saa7134_enum_fmt_vid_cap(struct file
*file, void *priv,
if (f->index >= FORMATS)
return -EINVAL;
+ f->index = array_index_nospec(f->index, FORMATS);
+
strlcpy(f->description, formats[f->index].name,
sizeof(f->description));
diff --git a/drivers/media/pci/tw68/tw68-video.c
b/drivers/media/pci/tw68/tw68-video.c
index 8c1f4a0..a6cfb4b 100644
--- a/drivers/media/pci/tw68/tw68-video.c
#include <media/v4l2-event.h>
#include <media/videobuf2-dma-sg.h>
+#include <linux/nospec.h>
+
#include "tw68.h"
#include "tw68-reg.h"
@@ -789,6 +791,8 @@ static int tw68_enum_fmt_vid_cap(struct file *file,
void *priv,
if (f->index >= FORMATS)
return -EINVAL;
+ f->index = array_index_nospec(f->index, FORMATS);
+
strlcpy(f->description, formats[f->index].name,
sizeof(f->description));
diff --git a/drivers/media/pci/tw686x/tw686x-video.c
b/drivers/media/pci/tw686x/tw686x-video.c
index c3fafa9..281d722 100644
--- a/drivers/media/pci/tw686x/tw686x-video.c
+++ b/drivers/media/pci/tw686x/tw686x-video.c
@@ -25,6 +25,8 @@
#include "tw686x.h"
#include "tw686x-regs.h"
+#include <linux/nospec.h>
+
#define TW686X_INPUTS_PER_CH 4
#define TW686X_VIDEO_WIDTH 720
#define TW686X_VIDEO_HEIGHT(id) ((id & V4L2_STD_525_60)
? 480 : 576)
@@ -981,6 +983,7 @@ static int tw686x_enum_fmt_vid_cap(struct file
*file, void *priv,
{
if (f->index >= ARRAY_SIZE(formats))
return -EINVAL;
+ f->index = array_index_nospec(f->index, ARRAY_SIZE(formats));
f->pixelformat = formats[f->index].fourcc;
return 0;
}
Thanks
--
Gustavo
next prev parent reply other threads:[~2018-04-26 21:42 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-23 17:37 [PATCH 00/11] fix potential Spectre variant 1 issues Gustavo A. R. Silva
2018-04-23 17:38 ` [PATCH 01/11] media: tm6000: fix potential Spectre variant 1 Gustavo A. R. Silva
2018-04-23 18:24 ` Mauro Carvalho Chehab
2018-04-23 19:11 ` Gustavo A. R. Silva
2018-04-23 19:17 ` Mauro Carvalho Chehab
2018-04-23 19:22 ` Gustavo A. R. Silva
2018-04-26 21:41 ` Gustavo A. R. Silva [this message]
2018-04-26 23:42 ` Mauro Carvalho Chehab
2018-05-15 3:31 ` Gustavo A. R. Silva
2018-05-15 11:59 ` Mauro Carvalho Chehab
2018-05-15 14:16 ` Dan Carpenter
2018-05-15 17:29 ` Gustavo A. R. Silva
2018-05-15 19:00 ` Mauro Carvalho Chehab
2018-05-16 13:11 ` Dan Carpenter
2018-05-16 13:36 ` Mauro Carvalho Chehab
2018-05-15 19:39 ` Dan Carpenter
2018-05-17 1:14 ` Gustavo A. R. Silva
2018-05-17 10:36 ` Gustavo A. R. Silva
2018-05-17 11:34 ` Mauro Carvalho Chehab
2018-05-17 11:43 ` Mauro Carvalho Chehab
2018-05-17 12:13 ` Mauro Carvalho Chehab
2018-05-17 18:08 ` Gustavo A. R. Silva
2018-05-21 16:18 ` Gustavo A. R. Silva
2018-04-24 9:35 ` Dan Carpenter
2018-04-24 10:11 ` Mauro Carvalho Chehab
2018-04-24 10:36 ` Peter Zijlstra
2018-04-24 11:21 ` Peter Zijlstra
2018-04-24 17:47 ` Mauro Carvalho Chehab
2018-04-24 18:48 ` Peter Zijlstra
2018-04-23 17:38 ` [PATCH 02/11] exynos4-is: mipi-csis: " Gustavo A. R. Silva
2018-04-23 17:39 ` [PATCH 03/11] fsl-viu: " Gustavo A. R. Silva
2018-04-23 17:40 ` [PATCH 04/11] marvell-ccic: mcam-core: " Gustavo A. R. Silva
2018-04-23 17:41 ` [PATCH 05/11] omap_vout: " Gustavo A. R. Silva
2018-04-23 17:47 ` [PATCH 06/11] rcar-v4l2: " Gustavo A. R. Silva
2018-04-23 17:48 ` [PATCH 07/11] rcar_drif: " Gustavo A. R. Silva
2018-04-23 17:48 ` [PATCH 08/11] sh_vou: " Gustavo A. R. Silva
2018-04-23 17:50 ` [PATCH 09/11] vimc-debayer: " Gustavo A. R. Silva
2018-04-23 17:51 ` [PATCH 10/11] vivid-sdr-cap: " Gustavo A. R. Silva
2018-04-23 17:52 ` [PATCH 11/11] vsp1_rwpf: " Gustavo A. R. Silva
2018-04-23 19:13 ` [PATCH 00/11] fix potential Spectre variant 1 issues Gustavo A. R. Silva
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=99e158c0-1273-2500-da9e-b5ab31cba889@embeddedor.com \
--to=gustavo@embeddedor.com \
--cc=dan.carpenter@oracle.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).