On Tue, May 15, 2018 at 04:00:33PM -0300, Mauro Carvalho Chehab wrote: > Yeah, that's the same I'm getting from media upstream. > > > drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() > > warn: potential spectre issue 'pin->error_inj_args' > > This one seems a false positive, as the index var is u8 and the > array has 256 elements, as the userspace input from 'op' is > initialized with: > > u8 v; > u32 op; > > if (!kstrtou8(token, 0, &v)) > op = v; > It's hard to silence this because Smatch stores the current user controlled range list, not what it was initially. I wrote all this code to detect bounds checking errors, so there wasn't any need to save the range list before the bounds check. Since "op" is a u32, I can't even go by the type of the index.... > > drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write() > > warn: potential spectre issue 'ca->slot_info' (local cap) > > This one seems a real issue to me. Sent a patch for it. > > > drivers/media/dvb-core/dvb_net.c:252 handle_one_ule_extension() warn: > > potential spectre issue 'p->ule_next_hdr' > > I failed to see what's wrong here, or if this is exploited. Oh... Huh. This is a bug in smatch. That line looks like: p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN))); Smatch see the ntohs() and marks everything inside it as untrusted network data. I'll fix this. regards, dan carpenter
