Messages in this thread Patch in this message | | | From | Jeff Moyer <> | Subject | Re: [PATCH] aio: Convert ioctx_table to XArray | Date | Thu, 06 Dec 2018 17:21:31 -0500 |
| |
Matthew Wilcox <willy@infradead.org> writes:
> This custom resizing array was vulnerable to a Spectre attack (speculating > off the end of an array to a user-controlled offset). The XArray is > not vulnerable to Spectre as it always masks its lookups to be within > the bounds of the array.
I'm not a big fan of completely re-writing the code to fix this. Isn't the below patch sufficient?
-Jeff
diff --git a/fs/aio.c b/fs/aio.c index 97f983592925..9402ae0b63d5 100644 --- a/fs/aio.c +++ b/fs/aio.c @@ -1038,6 +1038,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) if (!table || id >= table->nr) goto out; + id = array_index_nospec(index, table->nr); ctx = rcu_dereference(table->table[id]); if (ctx && ctx->user_id == ctx_id) { if (percpu_ref_tryget_live(&ctx->users))
| |