Messages in this thread | | | Subject | Re: [RFC PATCH] asm/generic: introduce if_nospec and nospec_barrier | From | Dave Hansen <> | Date | Wed, 3 Jan 2018 21:49:33 -0800 |
| |
On 01/03/2018 09:44 PM, Dan Williams wrote: > No, the concern is that an fd value >= fdt->max_fds may cause the cpu > to read arbitrary memory addresses relative to files->fdt and > userspace can observe that it got loaded.
Yep, it potentially tells you someting about memory after fdt->fd[]. For instance, you might be able to observe if some random bit of memory after the actual fd[] array had 'mask' set because the CPU is running this code with a 'file' that actually fails the "fd < fdt->max_fds" check:
file = __fcheck_files(files, fd); if (!file || unlikely(file->f_mode & mask)) return 0; return (unsigned long)file;
| |