media: dvb_ca_en50221: prevent using slot_info for Spectre attacs

[mirror_ubuntu-bionic-kernel.git] / drivers / media / dvb-core / dvb_ca_en50221.c

diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index d48b61eb01f4cdc7f11913208a6beef0136a7bff..aadda661ad9c3e14aa8c0275f8f8219f4bd46ee8 100644 (file)
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -31,6 +31,7 @@
 #include <linux/slab.h>
 #include <linux/list.h>
 #include <linux/module.h>
+#include <linux/nospec.h>
 #include <linux/vmalloc.h>
 #include <linux/delay.h>
 #include <linux/spinlock.h>
@@ -1473,6 +1474,10 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
                return -EFAULT;
        buf += 2;
        count -= 2;
+
+       if (slot >= ca->slot_count)
+               return -EINVAL;
+       slot = array_index_nospec(slot, ca->slot_count);
        sl = &ca->slot_info[slot];
 
        /* check if the slot is actually running */