Commit e7a312f7 authored by Mauro Carvalho Chehab's avatar Mauro Carvalho Chehab Committed by Li Huafei
Browse files

media: av7110: fix a spectre vulnerability 

mainline inclusion
from mainline-v6.12-rc7
commit 458ea1c0be991573ec436aa0afa23baacfae101a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB5AVC
CVE: CVE-2024-50289

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=458ea1c0be991573ec436aa0afa23baacfae101a



--------------------------------

As warned by smatch:
	drivers/staging/media/av7110/av7110_ca.c:270 dvb_ca_ioctl() warn: potential spectre issue 'av7110->ci_slot' [w] (local cap)

There is a spectre-related vulnerability at the code. Fix it.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab+huawei@kernel.org>
Conflicts:
	drivers/staging/media/av7110/av7110.h
	drivers/staging/media/av7110/av7110_ca.c
[ Context conflict caused by unmerged commit f6ed8943fb06 ('media:
av7110: coding style fixes: logging'). ]
Signed-off-by: default avatarLi Huafei <lihuafei1@huawei.com>
parent e2e6e833

drivers/staging/media/av7110/av7110.h

+3 −1
Original line number Diff line number Diff line
@@ -86,6 +86,8 @@ struct infrared { 
	u32			ir_config;

};



#define MAX_CI_SLOTS	2



/* place to store all the necessary device information */

struct av7110 {
@@ -166,7 +168,7 @@ struct av7110 { 


	/* CA */



	struct ca_slot_info	ci_slot[2];

	struct ca_slot_info	ci_slot[MAX_CI_SLOTS];



	enum av7110_video_mode	vidmode;

	struct dmxdev		dmxdev;

drivers/staging/media/av7110/av7110_ca.c

+18 −8
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 
#include <linux/timer.h>

#include <linux/poll.h>

#include <linux/gfp.h>

#include <linux/nospec.h>



#include "av7110.h"

#include "av7110_hw.h"
@@ -26,23 +27,28 @@ 


void CI_handle(struct av7110 *av7110, u8 *data, u16 len)

{

	unsigned slot_num;



	dprintk(8, "av7110:%p\n",av7110);



	if (len < 3)

		return;

	switch (data[0]) {

	case CI_MSG_CI_INFO:

		if (data[2] != 1 && data[2] != 2)

		if (data[2] != 1 && data[2] != MAX_CI_SLOTS)

			break;



		slot_num = array_index_nospec(data[2] - 1, MAX_CI_SLOTS);



		switch (data[1]) {

		case 0:

			av7110->ci_slot[data[2] - 1].flags = 0;

			av7110->ci_slot[slot_num].flags = 0;

			break;

		case 1:

			av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_PRESENT;

			av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_PRESENT;

			break;

		case 2:

			av7110->ci_slot[data[2] - 1].flags |= CA_CI_MODULE_READY;

			av7110->ci_slot[slot_num].flags |= CA_CI_MODULE_READY;

			break;

		}

		break;
@@ -264,15 +270,19 @@ static int dvb_ca_ioctl(struct file *file, unsigned int cmd, void *parg) 
	case CA_GET_SLOT_INFO:

	{

		struct ca_slot_info *info=(struct ca_slot_info *)parg;

		unsigned int slot_num;



		if (info->num < 0 || info->num > 1) {

			mutex_unlock(&av7110->ioctl_mutex);

			return -EINVAL;

		}

		av7110->ci_slot[info->num].num = info->num;

		av7110->ci_slot[info->num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?

		slot_num = array_index_nospec(info->num, MAX_CI_SLOTS);



		av7110->ci_slot[slot_num].num = info->num;

		av7110->ci_slot[slot_num].type = FW_CI_LL_SUPPORT(av7110->arm_app) ?

						 CA_CI_LINK : CA_CI;

		memcpy(info, &av7110->ci_slot[info->num], sizeof(struct ca_slot_info));

		memcpy(info, &av7110->ci_slot[slot_num],

		       sizeof(struct ca_slot_info));

		break;

	}