• Dan Williams's avatar
    x86/get_user: Use pointer masking to limit speculation · c7f631cb
    Dan Williams authored
    Quoting Linus:
    
        I do think that it would be a good idea to very expressly document
        the fact that it's not that the user access itself is unsafe. I do
        agree that things like "get_user()" want to be protected, but not
        because of any direct bugs or problems with get_user() and friends,
        but simply because get_user() is an excellent source of a pointer
        that is obviously controlled from a potentially attacking user
        space. So it's a prime candidate for then finding _subsequent_
        accesses that can then be used to perturb the cache.
    
    Unlike the __get_user() case get_user() includes the address limit check
    near the pointer de-reference. With that locality the speculation can be
    mitigated with pointer narrowing rather than a barrier, i.e.
    array_index_nospec(). Where the narrowing is performed by:
    
    	cmp %limit, %ptr
    	sbb %mask, %mask
    	and %mask, %ptr
    
    With respect to speculation the value of %ptr is either less than %limit
    or NULL.
    Co-developed-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
    Signed-off-by: default avatarThomas Gleixner <tglx@linutronix.de>
    Cc: linux-arch@vger.kernel.org
    Cc: Kees Cook <keescook@chromium.org>
    Cc: kernel-hardening@lists.openwall.com
    Cc: gregkh@linuxfoundation.org
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: torvalds@linux-foundation.org
    Cc: alan@linux.intel.com
    Link: https://lkml.kernel.org/r/151727417469.33451.11804043010080838495.stgit@dwillia2-desk3.amr.corp.intel.com
    c7f631cb
getuser.S 3 KB