In 'rtl92d_dm_rxgain_tracking_thermalmeter()', add an extra 'index_mapping' array bounds check and use the convenient 'array_index_nospec()' to protect against spectre. Compile tested only. Found by Linux Verification Center (linuxtesting.org) with SVACE. Signed-off-by: Dmitry Antipov <dmantipov@xxxxxxxxx> --- drivers/net/wireless/realtek/rtlwifi/rtl8192d/dm_common.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192d/dm_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192d/dm_common.c index 20373ce998bf..44f1d3b40d22 100644 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8192d/dm_common.c +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192d/dm_common.c @@ -139,6 +139,9 @@ static void rtl92d_dm_rxgain_tracking_thermalmeter(struct ieee80211_hw *hw) u32 u4tmp; idx = rtlpriv->efuse.eeprom_thermalmeter - rtlpriv->dm.thermalvalue_rxgain; + if (WARN_ON_ONCE(idx < 0 || idx >= ARRAY_SIZE(index_mapping))) + return; + idx = array_index_nospec(idx, ARRAY_SIZE(index_mapping)); u4tmp = index_mapping[idx] << 12; rtl_dbg(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, -- 2.49.0
