From: "Theodore Y. Ts'o" <tytso@mit.edu>
To: Jeremy Cline <jcline@redhat.com>
Cc: Andreas Dilger <adilger.kernel@dilger.ca>,
linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org,
Josh Poimboeuf <jpoimboe@redhat.com>,
stable@vger.kernel.org
Subject: Re: [PATCH v2] ext4: mballoc: Fix spectre gadget in ext4_mb_regular_allocator
Date: Thu, 2 Aug 2018 00:06:09 -0400 [thread overview]
Message-ID: <20180802040609.GD9187@thunk.org> (raw)
In-Reply-To: <20180730180747.25200-1-jcline@redhat.com>
On Mon, Jul 30, 2018 at 06:07:47PM +0000, Jeremy Cline wrote:
> 'ac->ac_g_ex.fe_len' is a user-controlled value which is used in the
> derivation of 'ac->ac_2order'. 'ac->ac_2order', in turn, is used to
> index arrays which makes it a potential spectre gadget. Fix this by
> sanitizing the value assigned to 'ac->ac2_order'. This covers the
> following accesses found with the help of smatch:
>
> * fs/ext4/mballoc.c:1896 ext4_mb_simple_scan_group() warn: potential
> spectre issue 'grp->bb_counters' [w] (local cap)
>
> * fs/ext4/mballoc.c:445 mb_find_buddy() warn: potential spectre issue
> 'EXT4_SB(e4b->bd_sb)->s_mb_offsets' [r] (local cap)
>
> * fs/ext4/mballoc.c:446 mb_find_buddy() warn: potential spectre issue
> 'EXT4_SB(e4b->bd_sb)->s_mb_maxs' [r] (local cap)
>
> Cc: Josh Poimboeuf <jpoimboe@redhat.com>
> Cc: stable@vger.kernel.org
> Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com>
> Signed-off-by: Jeremy Cline <jcline@redhat.com>
Thanks, applied.
- Ted
prev parent reply other threads:[~2018-08-02 4:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-30 18:07 [PATCH v2] ext4: mballoc: Fix spectre gadget in ext4_mb_regular_allocator Jeremy Cline
2018-07-30 18:36 ` Theodore Y. Ts'o
2018-07-30 18:46 ` Jeremy Cline
2018-07-30 19:38 ` Theodore Y. Ts'o
2018-07-30 18:54 ` Josh Poimboeuf
2018-08-02 4:06 ` Theodore Y. Ts'o [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180802040609.GD9187@thunk.org \
--to=tytso@mit.edu \
--cc=adilger.kernel@dilger.ca \
--cc=jcline@redhat.com \
--cc=jpoimboe@redhat.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.