In lecd_attach, if arg is < 0, it was treated as 0. Spectre v1 fix changed that. Bug does not exist in mainline AFAICT.
Signed-off-by: Pavel Machek <[email protected]> # for 4.19.y diff --git a/net/atm/lec.c b/net/atm/lec.c index ad4f829193f0..ed279cd912f4 100644 --- a/net/atm/lec.c +++ b/net/atm/lec.c @@ -731,7 +731,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg) i = arg; if (arg >= MAX_LEC_ITF) return -EINVAL; - i = array_index_nospec(arg, MAX_LEC_ITF); + i = array_index_nospec(i, MAX_LEC_ITF); if (!dev_lec[i]) { int size; -- (english) http://www.livejournal.com/~pavelmachek (cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html
signature.asc
Description: Digital signature
