From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Jordy Zomer <jordyzomer@google.com>,
Linus Torvalds <torvalds@linuxfoundation.org>,
Dave Hansen <dave.hansen@linux.intel.com>,
Thomas Gleixner <tglx@linutronix.de>,
Linus Torvalds <torvalds@linux-foundation.org>,
Daniel Borkmann <daniel@iogearbox.net>
Subject: [PATCH 6.1 29/46] uaccess: Add speculation barrier to copy_from_user()
Date: Thu, 23 Feb 2023 14:06:36 +0100 [thread overview]
Message-ID: <20230223130432.927957085@linuxfoundation.org> (raw)
In-Reply-To: <20230223130431.553657459@linuxfoundation.org>
From: Dave Hansen <dave.hansen@linux.intel.com>
commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 upstream.
The results of "access_ok()" can be mis-speculated. The result is that
you can end speculatively:
if (access_ok(from, size))
// Right here
even for bad from/size combinations. On first glance, it would be ideal
to just add a speculation barrier to "access_ok()" so that its results
can never be mis-speculated.
But there are lots of system calls just doing access_ok() via
"copy_to_user()" and friends (example: fstat() and friends). Those are
generally not problematic because they do not _consume_ data from
userspace other than the pointer. They are also very quick and common
system calls that should not be needlessly slowed down.
"copy_from_user()" on the other hand uses a user-controller pointer and
is frequently followed up with code that might affect caches. Take
something like this:
if (!copy_from_user(&kernelvar, uptr, size))
do_something_with(kernelvar);
If userspace passes in an evil 'uptr' that *actually* points to a kernel
addresses, and then do_something_with() has cache (or other)
side-effects, it could allow userspace to infer kernel data values.
Add a barrier to the common copy_from_user() code to prevent
mis-speculated values which happen after the copy.
Also add a stub for architectures that do not define barrier_nospec().
This makes the macro usable in generic code.
Since the barrier is now usable in generic code, the x86 #ifdef in the
BPF code can also go away.
Reported-by: Jordy Zomer <jordyzomer@google.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Daniel Borkmann <daniel@iogearbox.net> # BPF bits
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/nospec.h | 4 ++++
kernel/bpf/core.c | 2 --
lib/usercopy.c | 7 +++++++
3 files changed, 11 insertions(+), 2 deletions(-)
--- a/include/linux/nospec.h
+++ b/include/linux/nospec.h
@@ -11,6 +11,10 @@
struct task_struct;
+#ifndef barrier_nospec
+# define barrier_nospec() do { } while (0)
+#endif
+
/**
* array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
* @index: array element index
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -1908,9 +1908,7 @@ out:
* reuse preexisting logic from Spectre v1 mitigation that
* happens to produce the required code on x86 for v4 as well.
*/
-#ifdef CONFIG_X86
barrier_nospec();
-#endif
CONT;
#define LDST(SIZEOP, SIZE) \
STX_MEM_##SIZEOP: \
--- a/lib/usercopy.c
+++ b/lib/usercopy.c
@@ -3,6 +3,7 @@
#include <linux/fault-inject-usercopy.h>
#include <linux/instrumented.h>
#include <linux/uaccess.h>
+#include <linux/nospec.h>
/* out-of-line parts */
@@ -12,6 +13,12 @@ unsigned long _copy_from_user(void *to,
unsigned long res = n;
might_fault();
if (!should_fail_usercopy() && likely(access_ok(from, n))) {
+ /*
+ * Ensure that bad access_ok() speculation will not
+ * lead to nasty side effects *after* the copy is
+ * finished:
+ */
+ barrier_nospec();
instrument_copy_from_user_before(to, from, n);
res = raw_copy_from_user(to, from, n);
instrument_copy_from_user_after(to, from, n, res);
next prev parent reply other threads:[~2023-02-23 13:09 UTC|newest]
Thread overview: 52+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-23 13:06 [PATCH 6.1 00/46] 6.1.14-rc1 review Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 01/46] drm/etnaviv: dont truncate physical page address Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 02/46] wifi: ath11k: fix warning in dma_free_coherent() of memory chunks while recovery Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 03/46] wifi: rtl8xxxu: gen2: Turn on the rate control Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 04/46] drm/edid: Fix minimum bpc supported with DSC1.2 for HDMI sink Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 05/46] clk: mxl: Switch from direct readl/writel based IO to regmap based IO Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 06/46] clk: mxl: Remove redundant spinlocks Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 07/46] clk: mxl: Add option to override gate clks Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 08/46] clk: mxl: Fix a clk entry by adding relevant flags Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 09/46] powerpc: dts: t208x: Mark MAC1 and MAC2 as 10G Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 10/46] clk: mxl: syscon_node_to_regmap() returns error pointers Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 11/46] sched/psi: Stop relying on timer_pending() for poll_work rescheduling Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 12/46] random: always mix cycle counter in add_latent_entropy() Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 13/46] scsi: libsas: Add smp_ata_check_ready_type() Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 14/46] scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 15/46] spi: mediatek: Enable irq when pdata is ready Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 16/46] docs: perf: Fix PMU instance name of hisi-pcie-pmu Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 17/46] KVM: x86: Fail emulation during EMULTYPE_SKIP on any exception Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 18/46] KVM: SVM: Skip WRMSR fastpath on VM-Exit if next RIP isnt valid Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 19/46] KVM: VMX: Execute IBPB on emulated VM-exit when guest has IBRS Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 20/46] can: kvaser_usb: hydra: help gcc-13 to figure out cmd_len Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 21/46] powerpc: dts: t208x: Disable 10G on MAC1 and MAC2 Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 22/46] spi: mediatek: Enable irq before the spi registration Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 23/46] drm/i915: Remove __maybe_unused from mtl_info Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 24/46] KVM: x86: fix deadlock for KVM_XEN_EVTCHN_RESET Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 25/46] selftests: kvm: move declaration at the beginning of main() Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 26/46] powerpc/64s/radix: Fix RWX mapping with relocated kernel Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 27/46] nfp: ethtool: support reporting link modes Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 28/46] nfp: ethtool: fix the bug of setting unsupported port speed Greg Kroah-Hartman
2023-02-23 13:06 ` Greg Kroah-Hartman [this message]
2023-02-23 13:06 ` [PATCH 6.1 30/46] x86/alternatives: Introduce int3_emulate_jcc() Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 31/46] x86/alternatives: Teach text_poke_bp() to patch Jcc.d32 instructions Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 32/46] x86/static_call: Add support for Jcc tail-calls Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 33/46] Bluetooth: btusb: Add more device IDs for WCN6855 Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 34/46] riscv: remove special treatment for the link order of head.o Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 35/46] arm64: " Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 36/46] arch: fix broken BuildID for arm64 and riscv Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 37/46] powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 38/46] powerpc/vmlinux.lds: Dont discard .rela* for relocatable builds Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 39/46] s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36 Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 40/46] sh: define RUNTIME_DISCARD_EXIT Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 41/46] wifi: mwifiex: Add missing compatible string for SD8787 Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 42/46] audit: update the mailing list in MAINTAINERS Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 43/46] platform/x86/amd/pmf: Add depends on CONFIG_POWER_SUPPLY Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 44/46] platform/x86: nvidia-wmi-ec-backlight: Add force module parameter Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 45/46] ext4: Fix function prototype mismatch for ext4_feat_ktype Greg Kroah-Hartman
2023-02-23 13:06 ` [PATCH 6.1 46/46] randstruct: disable Clang 15 support Greg Kroah-Hartman
2023-02-23 14:33 ` [PATCH 6.1 00/46] 6.1.14-rc1 review Conor Dooley
2023-02-23 14:37 ` Greg Kroah-Hartman
2023-02-23 14:41 ` Conor Dooley
2023-02-23 14:38 ` Naresh Kamboju
2023-02-23 16:31 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230223130432.927957085@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=daniel@iogearbox.net \
--cc=dave.hansen@linux.intel.com \
--cc=jordyzomer@google.com \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=torvalds@linuxfoundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).