libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()
authorJohn Garry <john.garry@huawei.com>
Fri, 8 Jun 2018 10:26:33 +0000 (18:26 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 24 Aug 2018 11:09:00 +0000 (13:09 +0200)
commit7ccd2c1be366d249e7c67997dbc930d5be0879b1
treecc4578b3c29d58dcc18341a4b2ae0be1f4e03676
parented4afe79ba5a2f6761e10b1a91920796d3164ef9
libahci: Fix possible Spectre-v1 pmp indexing in ahci_led_store()

[ Upstream commit fae2a63737e5973f1426bc139935a0f42e232844 ]

Currently smatch warns of possible Spectre-V1 issue in ahci_led_store():
drivers/ata/libahci.c:1150 ahci_led_store() warn: potential spectre issue 'pp->em_priv' (local cap)

Userspace controls @pmp from following callchain:
em_message->store()
->ata_scsi_em_message_store()
-->ap->ops->em_store()
--->ahci_led_store()

After the mask+shift @pmp is effectively an 8b value, which is used to
index into an array of length 8, so sanitize the array index.

Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/ata/libahci.c