diff options
| author | Wolfram Sang <wsa@the-dreams.de> | 2018-05-17 16:29:19 +0200 |
|---|---|---|
| committer | Wolfram Sang <wsa@the-dreams.de> | 2018-05-17 16:29:19 +0200 |
| commit | 3d8b7a4ea310f3621a19d50cbe6cbc89bb23b82f (patch) | |
| tree | 51a261418928d8499ecade36f74e74fc92396503 /net/atm | |
| parent | c599eb4ff6e0f9c525695faab7149d8d48743b1c (diff) | |
| parent | caaccda136ae3fa1c5f6563aae22ca3c199f563a (diff) | |
Merge branch 'i2c/platform_data-immutable' into i2c/for-4.18
Diffstat (limited to 'net/atm')
| -rw-r--r-- | net/atm/lec.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/net/atm/lec.c b/net/atm/lec.c index 01d5d20a6eb1..3138a869b5c0 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 }; #include <linux/module.h> #include <linux/init.h> +/* Hardening for Spectre-v1 */ +#include <linux/nospec.h> + #include "lec.h" #include "lec_arpc.h" #include "resources.h" @@ -687,8 +690,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); if (bytes_left != 0) pr_info("copy from user failed for %d bytes\n", bytes_left); - if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || - !dev_lec[ioc_data.dev_num]) + if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF) + return -EINVAL; + ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF); + if (!dev_lec[ioc_data.dev_num]) return -EINVAL; vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL); if (!vpriv) |