Messages in this thread | | | Date | Wed, 2 Jun 2021 15:11:13 -0500 | From | Josh Poimboeuf <> | Subject | Re: [PATCH v4 3/4] x86/uaccess: Use pointer masking to limit uaccess speculation |
| |
On Wed, Jun 02, 2021 at 05:11:57PM +0000, Sean Christopherson wrote: > On Tue, May 04, 2021, Josh Poimboeuf wrote: > > The x86 uaccess code uses barrier_nospec() in various places to prevent > > speculative dereferencing of user-controlled pointers (which might be > > combined with further gadgets or CPU bugs to leak data). > > > > There are some issues with the current implementation: > > > > - The barrier_nospec() in copy_from_user() was inadvertently removed > > with: 4b842e4e25b1 ("x86: get rid of small constant size cases in > > raw_copy_{to,from}_user()") > > Mostly out of curiosity, wasn't copy_{from,to}_user() flawed even before that > patch? Non-constant sizes would go straight to copy_user_generic(), and even if > string ops are used and strings are magically not vulnerable, small sizes would > skip to normal loads/stores in _copy_short_string when using > copy_user_enhanced_fast_string().
Yes, it appears so.
-- Josh
| |