Messages in this thread | | | From | Andy Lutomirski <> | Date | Tue, 6 Feb 2018 20:49:39 +0000 | Subject | Re: [PATCH v4 07/10] x86: narrow out of bounds syscalls to sys_read under speculation |
| |
On Tue, Feb 6, 2018 at 8:42 PM, Linus Torvalds <torvalds@linux-foundation.org> wrote: > On Tue, Feb 6, 2018 at 12:37 PM, Dan Williams <dan.j.williams@intel.com> wrote: >> >> Are there any compilers that would miscompile: >> >> mask = 0 - (index < size); >> >> That might be a way to improve the assembly. > > Sadly, that is *very* easy to miscompile. In fact, I'd be very > surprised indeed if any compiler worth its name wouldn't combine the > comparison with the conditional branch it accompanies, and just turn > that into a constant. IOW, you'd get > > mask = 0 - (index < size); > if (index <= size) { > ... use mask .. > > and the compiler would just turn that into > > if (index <= size) { > mask = -1; > > and be done with it. > > Linus
Can you use @cc to make an asm statement that outputs both the masked array index and the "if" condition? I can never remember the syntax, but something like:
asm ("cmp %[limit], %[index]\n\tcmovae %[zero], %[index]" : [index] "+" (index), "@ccb" (result));
Then you shove this into a statement expression macro so you can do:
if (index_mask_nospec(&nr, NR_syscalls)) { ... sys_call_table[nr] ..; }
(Caveat emptor: I can also *ever* remember which way the $*!& AT&T syntax cmp instruction goes.)
A down side is that nr actually ends up containing zero outside the if. *That* could be avoided with jump labels.
--Andy
| |