![]() As recently Smatch suggested, a couple of places in ASIHPI driver may expand the array directly from the user-space value with speculation: sound/pci/asihpi/hpimsginit.c:70 hpi_init_response() warn: potential spectre issue 'res_size' (local cap) sound/pci/asihpi/hpioctl.c:189 asihpi_hpi_ioctl() warn: potential spectre issue 'adapters' This patch puts array_index_nospec() for hardening against them. BugLink: https://marc.info/?l=linux-kernel&m=152411496503418&w=2 Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Cc: <stable@vger.kernel.org> Signed-off-by: Takashi Iwai <tiwai@suse.de> |
||
---|---|---|
.. | ||
asihpi.c | ||
hpi.h | ||
hpi6000.c | ||
hpi6000.h | ||
hpi6205.c | ||
hpi6205.h | ||
hpi_internal.h | ||
hpi_version.h | ||
hpicmn.c | ||
hpicmn.h | ||
hpidebug.c | ||
hpidebug.h | ||
hpidspcd.c | ||
hpidspcd.h | ||
hpifunc.c | ||
hpimsginit.c | ||
hpimsginit.h | ||
hpimsgx.c | ||
hpimsgx.h | ||
hpioctl.c | ||
hpioctl.h | ||
hpios.c | ||
hpios.h | ||
hpipcida.h | ||
Makefile |