Dan Williams 9a7e3d7f05 ACPI: NFIT: Fix input validation of bus-family
Dan reports that smatch thinks userspace can craft an out-of-bound bus
family number. However, nd_cmd_clear_to_send() blocks all non-zero
values of bus-family since only the kernel can initiate these commands.
However, in the speculation path, family is a user controlled array
index value so mask it for speculation safety. Also, since the
nd_cmd_clear_to_send() safety is non-obvious and possibly may change in
the future include input validation as if userspace could get past the
nd_cmd_clear_to_send() gatekeeper.

Link: http://lore.kernel.org/r/20201111113000.GA1237157@mwanda
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: 6450ddbd5d8e ("ACPI: NFIT: Define runtime firmware activation commands")
Cc: <stable@vger.kernel.org>
Signed-off-by: Dan Williams <dan.j.williams@intel.com>
2020-11-23 17:43:53 -08:00
..
2020-10-23 10:06:38 -07:00
2020-10-15 14:43:29 -07:00
2020-11-10 18:52:51 +01:00
2020-10-14 11:42:04 -07:00
2019-06-23 09:23:33 +02:00
2020-10-15 10:46:16 -07:00
2020-11-09 19:08:06 +01:00
2020-10-27 19:30:27 +01:00
2020-11-09 19:08:06 +01:00
2020-11-09 19:25:20 +01:00
2020-11-10 18:52:51 +01:00
2019-11-13 11:12:08 +01:00
2020-11-09 19:08:06 +01:00
2020-11-09 19:08:06 +01:00
2020-08-05 10:51:40 -07:00
2020-11-09 19:08:06 +01:00
2020-11-09 19:08:06 +01:00
2020-11-09 19:08:06 +01:00
2020-06-02 13:25:52 -07:00
2020-07-09 14:09:28 +02:00
2020-10-22 18:58:26 +02:00
2020-11-09 19:08:06 +01:00