LKML Archive on
help / color / mirror / Atom feed
From: David Miller <>
Subject: Re: [PATCH] net: atm: Fix potential Spectre v1
Date: Fri, 04 May 2018 12:54:13 -0400 (EDT)	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: "Gustavo A. R. Silva" <>
Date: Thu, 3 May 2018 13:45:58 -0500

> ioc_data.dev_num can be controlled by user-space, hence leading to
> a potential exploitation of the Spectre variant 1 vulnerability.
> This issue was detected with the help of Smatch:
> net/atm/lec.c:702 lec_vcc_attach() warn: potential spectre issue
> 'dev_lec'
> Fix this by sanitizing ioc_data.dev_num before using it to index
> dev_lec. Also, notice that there is another instance in which array
> dev_lec is being indexed using ioc_data.dev_num at line 705:
> lec_vcc_added(netdev_priv(dev_lec[ioc_data.dev_num]),
> Notice that given that speculation windows are large, the policy is
> to kill the speculation on the first load and not worry if it can be
> completed with a dependent load/store [1].
> [1]
> Cc:
> Signed-off-by: Gustavo A. R. Silva <>

Applied and queued up for -stable, thanks.

      reply	other threads:[~2018-05-04 16:54 UTC|newest]

Thread overview: 2+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-05-03 18:45 Gustavo A. R. Silva
2018-05-04 16:54 ` David Miller [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \
    --subject='Re: [PATCH] net: atm: Fix potential Spectre v1' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).