From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225v+QxIL6ozpUL4/3TngaxUFPll9ddbNEQSoQlIuEDH93uN3UEYF1xuO1PLE7DkRJJ6CL9N ARC-Seal: i=1; a=rsa-sha256; t=1518708731; cv=none; d=google.com; s=arc-20160816; b=ADxQ/K0kU5kbh3RjP2ByQ6F1BgRg5wxs11SU12TiFu89W3BpcQ/SZqZWmMenkqe+gx tu4sNv0gQ9FBiMxtAYIk/CLjKWxeqN82Roq9EZqpzRCmxZrzN8b4NLqI6xwT4762T/jd Cm+1WCWn5DUD74kVhSX5/5PJ8xsXjnqFZMupJIkVssGu51P7jU9otnPZD2zj3aOiOjMy tE4SlteLvpaDI4nDOO1vy+Hxyvrs5oGYDjw9SXn8zU2np9ITjxAS9k3CC8Ivt6Acj6ia NOjRDPk6EWdaI2KhS7m3Y5kJoY2tdpBMtHpeepmlTwPOkefv8wBMcVCBN7NZPPrdB6FN f0DA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=1wgFIfW5X5ZcfpuJxoIOYLtzJjS3Ptb3pliisbZlumQ=; b=gMwciGm/4vpxOxFyCfgVD4zrSU1aiQ+7XZCQVVp/NOOVarjv5DlK/AsFWX57BVVg/Z nP9+pgkrlikOH2leBn5PqtgDXcknjRPDuy2RTf0TwZBM97/rhhJSB/X8mv4VFmghTTZY 4o8vtQbEBkpcambaimLaCvLz/v1EaMTB4eyCY99ZFY+FGhsgSgdO8CfNqBr6+pKM/PMy jWg+j0e2Ueb3nz5ODnFAwi20+tT9nInQmAa52326F7NUQaPLxSc46bba+PRicpYVgPRf wmN2pHbjJfPXFHBuxWeziT7+bMsirVcetai92IeyB7oTRGx3xzCQP2lZxX/ykJd5Qq+f FR6A== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Rutland , Will Deacon , Catalin Marinas , Ard Biesheuvel Subject: [PATCH 4.14 060/195] [Variant 1/Spectre-v1] arm64: entry: Ensure branch through syscall table is bounded under speculation Date: Thu, 15 Feb 2018 16:15:51 +0100 Message-Id: <20180215151708.721857361@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180215151705.738773577@linuxfoundation.org> References: <20180215151705.738773577@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1592481526327320243?= X-GMAIL-MSGID: =?utf-8?q?1592481526327320243?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Will Deacon Commit 6314d90e6493 upstream. In a similar manner to array_index_mask_nospec, this patch introduces an assembly macro (mask_nospec64) which can be used to bound a value under speculation. This macro is then used to ensure that the indirect branch through the syscall table is bounded under speculation, with out-of-range addresses speculating as calls to sys_io_setup (0). Reviewed-by: Mark Rutland Signed-off-by: Will Deacon Signed-off-by: Catalin Marinas Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman --- arch/arm64/include/asm/assembler.h | 11 +++++++++++ arch/arm64/kernel/entry.S | 2 ++ 2 files changed, 13 insertions(+) --- a/arch/arm64/include/asm/assembler.h +++ b/arch/arm64/include/asm/assembler.h @@ -103,6 +103,17 @@ .endm /* + * Sanitise a 64-bit bounded index wrt speculation, returning zero if out + * of bounds. + */ + .macro mask_nospec64, idx, limit, tmp + sub \tmp, \idx, \limit + bic \tmp, \tmp, \idx + and \idx, \idx, \tmp, asr #63 + csdb + .endm + +/* * NOP sequence */ .macro nops, num --- a/arch/arm64/kernel/entry.S +++ b/arch/arm64/kernel/entry.S @@ -376,6 +376,7 @@ alternative_insn eret, nop, ARM64_UNMAP_ * x7 is reserved for the system call number in 32-bit mode. */ wsc_nr .req w25 // number of system calls +xsc_nr .req x25 // number of system calls (zero-extended) wscno .req w26 // syscall number xscno .req x26 // syscall number (zero-extended) stbl .req x27 // syscall table pointer @@ -884,6 +885,7 @@ el0_svc_naked: // compat entry point b.ne __sys_trace cmp wscno, wsc_nr // check upper syscall limit b.hs ni_sys + mask_nospec64 xscno, xsc_nr, x19 // enforce bounds for syscall number ldr x16, [stbl, xscno, lsl #3] // address in the syscall table blr x16 // call sys_* routine b ret_fast_syscall