* [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() [not found] <20180313152320.439085687@linuxfoundation.org> @ 2018-03-13 15:24 ` Greg Kroah-Hartman 2018-03-13 15:24 ` Greg Kroah-Hartman 2018-03-13 15:24 ` [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman 1 sibling, 1 reply; 4+ messages in thread From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw) To: linux-kernel Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Dan Williams, Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen, David Woodhouse, Josh Poimboeuf, Peter Zijlstra, Thomas Gleixner, Will Deacon, linux-arch, Ingo Molnar 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream. There are multiple problems with the dynamic sanity checking in array_index_nospec_mask_check(): * It causes unnecessary overhead in the 32-bit case since integer sized @index values will no longer cause the check to be compiled away like in the 64-bit case. * In the 32-bit case it may trigger with user controllable input when the expectation is that should only trigger during development of new kernel enabling. * The macro reuses the input parameter in multiple locations which is broken if someone passes an expression like 'index++' to array_index_nospec(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Link: http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- include/linux/nospec.h | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -30,26 +30,6 @@ static inline unsigned long array_index_ #endif /* - * Warn developers about inappropriate array_index_nospec() usage. - * - * Even if the CPU speculates past the WARN_ONCE branch, the - * sign bit of @index is taken into account when generating the - * mask. - * - * This warning is compiled out when the compiler can infer that - * @index and @size are less than LONG_MAX. - */ -#define array_index_mask_nospec_check(index, size) \ -({ \ - if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ - "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ - _mask = 0; \ - else \ - _mask = array_index_mask_nospec(index, size); \ - _mask; \ -}) - -/* * array_index_nospec - sanitize an array index after a bounds check * * For a code sequence like: @@ -67,7 +47,7 @@ static inline unsigned long array_index_ ({ \ typeof(index) _i = (index); \ typeof(size) _s = (size); \ - unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ + unsigned long _mask = array_index_mask_nospec(_i, _s); \ \ BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() 2018-03-13 15:24 ` [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() Greg Kroah-Hartman @ 2018-03-13 15:24 ` Greg Kroah-Hartman 0 siblings, 0 replies; 4+ messages in thread From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw) To: linux-kernel Cc: Greg Kroah-Hartman, stable, Linus Torvalds, Dan Williams, Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen, David Woodhouse, Josh Poimboeuf, Peter Zijlstra, Thomas Gleixner, Will Deacon, linux-arch, Ingo Molnar 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream. There are multiple problems with the dynamic sanity checking in array_index_nospec_mask_check(): * It causes unnecessary overhead in the 32-bit case since integer sized @index values will no longer cause the check to be compiled away like in the 64-bit case. * In the 32-bit case it may trigger with user controllable input when the expectation is that should only trigger during development of new kernel enabling. * The macro reuses the input parameter in multiple locations which is broken if someone passes an expression like 'index++' to array_index_nospec(). Reported-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Link: http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- include/linux/nospec.h | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -30,26 +30,6 @@ static inline unsigned long array_index_ #endif /* - * Warn developers about inappropriate array_index_nospec() usage. - * - * Even if the CPU speculates past the WARN_ONCE branch, the - * sign bit of @index is taken into account when generating the - * mask. - * - * This warning is compiled out when the compiler can infer that - * @index and @size are less than LONG_MAX. - */ -#define array_index_mask_nospec_check(index, size) \ -({ \ - if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ - "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ - _mask = 0; \ - else \ - _mask = array_index_mask_nospec(index, size); \ - _mask; \ -}) - -/* * array_index_nospec - sanitize an array index after a bounds check * * For a code sequence like: @@ -67,7 +47,7 @@ static inline unsigned long array_index_ ({ \ typeof(index) _i = (index); \ typeof(size) _s = (size); \ - unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ + unsigned long _mask = array_index_mask_nospec(_i, _s); \ \ BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency [not found] <20180313152320.439085687@linuxfoundation.org> 2018-03-13 15:24 ` [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() Greg Kroah-Hartman @ 2018-03-13 15:24 ` Greg Kroah-Hartman 2018-03-13 15:24 ` Greg Kroah-Hartman 1 sibling, 1 reply; 4+ messages in thread From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw) To: linux-kernel Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Dan Williams, Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen, David Woodhouse, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Will Deacon, linux-arch, Ingo Molnar 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream. The nospec.h header expects the per-architecture header file <asm/barrier.h> to optionally define array_index_mask_nospec(). Include that dependency to prevent inadvertent fallback to the default array_index_mask_nospec() implementation. The default implementation may not provide a full mitigation on architectures that perform data value speculation. Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Link: http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- include/linux/nospec.h | 1 + 1 file changed, 1 insertion(+) --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -5,6 +5,7 @@ #ifndef _LINUX_NOSPEC_H #define _LINUX_NOSPEC_H +#include <asm/barrier.h> /** * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency 2018-03-13 15:24 ` [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman @ 2018-03-13 15:24 ` Greg Kroah-Hartman 0 siblings, 0 replies; 4+ messages in thread From: Greg Kroah-Hartman @ 2018-03-13 15:24 UTC (permalink / raw) To: linux-kernel Cc: Greg Kroah-Hartman, stable, Christian Borntraeger, Dan Williams, Andy Lutomirski, Arjan van de Ven, Borislav Petkov, Dave Hansen, David Woodhouse, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra, Thomas Gleixner, Will Deacon, linux-arch, Ingo Molnar 4.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Dan Williams <dan.j.williams@intel.com> commit eb6174f6d1be16b19cfa43dac296bfed003ce1a6 upstream. The nospec.h header expects the per-architecture header file <asm/barrier.h> to optionally define array_index_mask_nospec(). Include that dependency to prevent inadvertent fallback to the default array_index_mask_nospec() implementation. The default implementation may not provide a full mitigation on architectures that perform data value speculation. Reported-by: Christian Borntraeger <borntraeger@de.ibm.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> Cc: Andy Lutomirski <luto@kernel.org> Cc: Arjan van de Ven <arjan@linux.intel.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Will Deacon <will.deacon@arm.com> Cc: linux-arch@vger.kernel.org Link: http://lkml.kernel.org/r/151881605404.17395.1341935530792574707.stgit@dwillia2-desk3.amr.corp.intel.com Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- include/linux/nospec.h | 1 + 1 file changed, 1 insertion(+) --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -5,6 +5,7 @@ #ifndef _LINUX_NOSPEC_H #define _LINUX_NOSPEC_H +#include <asm/barrier.h> /** * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-03-13 15:31 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20180313152320.439085687@linuxfoundation.org>
2018-03-13 15:24 ` [PATCH 4.15 080/146] nospec: Kill array_index_nospec_mask_check() Greg Kroah-Hartman
2018-03-13 15:24 ` Greg Kroah-Hartman
2018-03-13 15:24 ` [PATCH 4.15 081/146] nospec: Include <asm/barrier.h> dependency Greg Kroah-Hartman
2018-03-13 15:24 ` Greg Kroah-Hartman
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox