patches/kernel/0265-qla2xxx-prevent-speculative-execution.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Elena Reshetova <elena.reshetova@intel.com>
   3 Date: Mon, 4 Sep 2017 13:11:49 +0300
   4 Subject: [PATCH] qla2xxx: prevent speculative execution
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 CVE-2017-5753
  10 CVE-2017-5715
  11
  12 Real commit text tbd
  13
  14 Signed-off-by: Elena Reshetova <elena.reshetova@intel.com>
  15 Signed-off-by: Tim Chen <tim.c.chen@linux.intel.com>
  16 Signed-off-by: Andy Whitcroft <apw@canonical.com>
  17 Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
  18 (cherry picked from commit d71318e5f16371dbc0e89a786336a521551f8946)
  19 Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
  20 ---
  21  drivers/scsi/qla2xxx/qla_mr.c | 12 ++++++++----
  22  1 file changed, 8 insertions(+), 4 deletions(-)
  23
  24 diff --git a/drivers/scsi/qla2xxx/qla_mr.c b/drivers/scsi/qla2xxx/qla_mr.c
  25 index 10b742d27e16..ca923d8803f9 100644
  26 --- a/drivers/scsi/qla2xxx/qla_mr.c
  27 +++ b/drivers/scsi/qla2xxx/qla_mr.c
  28 @@ -2304,10 +2304,12 @@ qlafx00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt)
  29         req = ha->req_q_map[que];
  30
  31         /* Validate handle. */
  32 -       if (handle < req->num_outstanding_cmds)
  33 +       if (handle < req->num_outstanding_cmds) {
  34 +               gmb();
  35                 sp = req->outstanding_cmds[handle];
  36 -       else
  37 +       } else {
  38                 sp = NULL;
  39 +       }
  40
  41         if (sp == NULL) {
  42                 ql_dbg(ql_dbg_io, vha, 0x3034,
  43 @@ -2655,10 +2657,12 @@ qlafx00_multistatus_entry(struct scsi_qla_host *vha,
  44                 req = ha->req_q_map[que];
  45
  46                 /* Validate handle. */
  47 -               if (handle < req->num_outstanding_cmds)
  48 +               if (handle < req->num_outstanding_cmds) {
  49 +                       gmb();
  50                         sp = req->outstanding_cmds[handle];
  51 -               else
  52 +               } else {
  53                         sp = NULL;
  54 +               }
  55
  56                 if (sp == NULL) {
  57                         ql_dbg(ql_dbg_io, vha, 0x3044,
  58 --
  59 2.14.2
  60