lkml.org 
[lkml]   [2020]   [Sep]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation
    On Tue, Sep 01, 2020 at 03:02:08PM +0100, Mark Rutland wrote:
    > d instead do user pointer
    > > masking, throughout the x86 uaccess code. This is similar to what arm64
    > > is already doing.
    > >
    > > barrier_nospec() is now unused, and can be removed.
    >
    > One thing to consider is whether you need a speculation barrier after
    > set_fs(). Otherwise for code like:
    >
    > | fs = get_fs();
    > | if (cond)
    > | set_fs(KERNEL_DS);
    > | copy_to_user(...)
    > | set_fs(fs)
    >
    > ... the set_fs() can occur speculatively, and may be able to satisfy
    > the masking logic if forwarded within the cpu.
    >
    > See arm64 commit:
    >
    > c2f0ad4fc089cff8 ("arm64: uaccess: Prevent speculative use of the current addr_limit")

    Do you have any examples of that conditional set_fs(KERNEL_DS) pattern?
    I wasn't able to find any.

    --
    Josh

    \
     
     \ /
      Last update: 2020-09-01 16:24    [W:2.131 / U:0.076 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site