From: Josh Poimboeuf <jpoimboe@redhat.com>
To: Sean Christopherson <seanjc@google.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>,
x86@kernel.org, linux-kernel@vger.kernel.org,
Linus Torvalds <torvalds@linux-foundation.org>,
Will Deacon <will@kernel.org>,
Dan Williams <dan.j.williams@intel.com>,
Andrea Arcangeli <aarcange@redhat.com>,
Waiman Long <longman@redhat.com>,
Peter Zijlstra <peterz@infradead.org>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Cooper <andrew.cooper3@citrix.com>,
Andy Lutomirski <luto@kernel.org>, Christoph Hellwig <hch@lst.de>,
David Laight <David.Laight@aculab.com>,
Mark Rutland <mark.rutland@arm.com>,
Borislav Petkov <bp@alien8.de>
Subject: Re: [PATCH v4 3/4] x86/uaccess: Use pointer masking to limit uaccess speculation
Date: Wed, 2 Jun 2021 15:11:13 -0500 [thread overview]
Message-ID: <20210602201113.gsuw7km3lkupg6r7@treble> (raw)
In-Reply-To: <YLe73YcUeXBaLwHr@google.com>
On Wed, Jun 02, 2021 at 05:11:57PM +0000, Sean Christopherson wrote:
> On Tue, May 04, 2021, Josh Poimboeuf wrote:
> > The x86 uaccess code uses barrier_nospec() in various places to prevent
> > speculative dereferencing of user-controlled pointers (which might be
> > combined with further gadgets or CPU bugs to leak data).
> >
> > There are some issues with the current implementation:
> >
> > - The barrier_nospec() in copy_from_user() was inadvertently removed
> > with: 4b842e4e25b1 ("x86: get rid of small constant size cases in
> > raw_copy_{to,from}_user()")
>
> Mostly out of curiosity, wasn't copy_{from,to}_user() flawed even before that
> patch? Non-constant sizes would go straight to copy_user_generic(), and even if
> string ops are used and strings are magically not vulnerable, small sizes would
> skip to normal loads/stores in _copy_short_string when using
> copy_user_enhanced_fast_string().
Yes, it appears so.
--
Josh
next prev parent reply other threads:[~2021-06-02 20:11 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-05 3:54 [PATCH v4 0/4] x86/uaccess: Use pointer masking to limit uaccess speculation Josh Poimboeuf
2021-05-05 3:54 ` [PATCH v4 1/4] uaccess: Always inline strn*_user() helper functions Josh Poimboeuf
2021-05-05 3:54 ` [PATCH v4 2/4] uaccess: Fix __user annotations for copy_mc_to_user() Josh Poimboeuf
2021-05-05 3:54 ` [PATCH v4 3/4] x86/uaccess: Use pointer masking to limit uaccess speculation Josh Poimboeuf
2021-05-05 8:48 ` David Laight
2021-05-05 13:19 ` Josh Poimboeuf
2021-05-05 13:51 ` David Laight
2021-05-05 18:32 ` Linus Torvalds
2021-05-06 7:57 ` David Laight
2021-05-05 14:25 ` Mark Rutland
2021-05-05 14:48 ` Josh Poimboeuf
2021-05-05 14:49 ` David Laight
2021-05-05 15:45 ` Mark Rutland
2021-05-05 16:55 ` Andy Lutomirski
2021-05-06 8:36 ` David Laight
2021-05-06 12:05 ` Christoph Hellwig
2021-06-02 17:11 ` Sean Christopherson
2021-06-02 20:11 ` Josh Poimboeuf [this message]
2021-05-05 3:54 ` [PATCH v4 4/4] x86/nospec: Remove barrier_nospec() Josh Poimboeuf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210602201113.gsuw7km3lkupg6r7@treble \
--to=jpoimboe@redhat.com \
--cc=David.Laight@aculab.com \
--cc=aarcange@redhat.com \
--cc=andrew.cooper3@citrix.com \
--cc=bp@alien8.de \
--cc=dan.j.williams@intel.com \
--cc=hch@lst.de \
--cc=linux-kernel@vger.kernel.org \
--cc=longman@redhat.com \
--cc=luto@kernel.org \
--cc=mark.rutland@arm.com \
--cc=peterz@infradead.org \
--cc=seanjc@google.com \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.