lkml.org 
[lkml]   [2018]   [Dec]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    SubjectRe: [PATCH] aio: Convert ioctx_table to XArray
    Date
    Matthew Wilcox <willy@infradead.org> writes:

    > This custom resizing array was vulnerable to a Spectre attack (speculating
    > off the end of an array to a user-controlled offset). The XArray is
    > not vulnerable to Spectre as it always masks its lookups to be within
    > the bounds of the array.

    I'm not a big fan of completely re-writing the code to fix this. Isn't
    the below patch sufficient?

    -Jeff

    diff --git a/fs/aio.c b/fs/aio.c
    index 97f983592925..9402ae0b63d5 100644
    --- a/fs/aio.c
    +++ b/fs/aio.c
    @@ -1038,6 +1038,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id)
    if (!table || id >= table->nr)
    goto out;

    + id = array_index_nospec(index, table->nr);
    ctx = rcu_dereference(table->table[id]);
    if (ctx && ctx->user_id == ctx_id) {
    if (percpu_ref_tryget_live(&ctx->users))
    \
     
     \ /
      Last update: 2018-12-06 23:22    [W:3.678 / U:1.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site