From: Linus Torvalds <torvalds@linux-foundation.org>
To: Jann Horn <jannh@google.com>
Cc: Dan Williams <dan.j.williams@intel.com>,
kernel list <linux-kernel@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
Catalin Marinas <catalin.marinas@arm.com>,
the arch/x86 maintainers <x86@kernel.org>,
Will Deacon <will.deacon@arm.com>,
Russell King <linux@armlinux.org.uk>,
Ingo Molnar <mingo@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
Alan Cox <alan@linux.intel.com>
Subject: Re: [PATCH v4 02/10] asm/nospec, array_ptr: sanitize speculative array de-references
Date: Fri, 19 Jan 2018 10:18:53 -0800 [thread overview]
Message-ID: <CA+55aFw-RNg4diZ0RCVkEYAANDp22YDskNOR913vKQEBdarJSw@mail.gmail.com> (raw)
In-Reply-To: <CAG48ez0Y97-gyzWBmcVbUyLuzUG42To=Mm8PAKuzWma6XbFmew@mail.gmail.com>
On Fri, Jan 19, 2018 at 2:20 AM, Jann Horn <jannh@google.com> wrote:
>> + \
>> + __u._ptr = _arr + (_i & _mask); \
>> + __u._bit &= _mask; \
>
> AFAICS, if `idx` is out of bounds, you first zero out the index
> (`_i & _mask`) and then immediately afterwards zero out
> the whole pointer (`_u._bit &= _mask`).
> Is there a reason for the `_i & _mask`, and if so, can you
> add a comment explaining that?
I think that's just leftovers from my original (untested) thing that
also did the access itself. So that __u._bit masking wasn't masking
the pointer, it was masking the value that was *read* from the
pointer, so that you could know that an invalid access returned
0/NULL, not just the first value in the array.
Linus
WARNING: multiple messages have this Message-ID (diff)
From: Linus Torvalds <torvalds@linux-foundation.org>
To: Jann Horn <jannh@google.com>
Cc: Dan Williams <dan.j.williams@intel.com>,
kernel list <linux-kernel@vger.kernel.org>,
linux-arch <linux-arch@vger.kernel.org>,
Kernel Hardening <kernel-hardening@lists.openwall.com>,
Catalin Marinas <catalin.marinas@arm.com>,
the arch/x86 maintainers <x86@kernel.org>,
Will Deacon <will.deacon@arm.com>,
Russell King <linux@armlinux.org.uk>,
Ingo Molnar <mingo@redhat.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"H. Peter Anvin" <hpa@zytor.com>,
Thomas Gleixner <tglx@linutronix.de>,
Andrew Morton <akpm@linux-foundation.org>,
Alan Cox <alan@linux.intel.com>
Subject: Re: [kernel-hardening] [PATCH v4 02/10] asm/nospec, array_ptr: sanitize speculative array de-references
Date: Fri, 19 Jan 2018 10:18:53 -0800 [thread overview]
Message-ID: <CA+55aFw-RNg4diZ0RCVkEYAANDp22YDskNOR913vKQEBdarJSw@mail.gmail.com> (raw)
Message-ID: <20180119181853.ZWcSKSwfcMoOoITWlsf3pk5BfgZxIQnaguWkVxmrVEk@z> (raw)
In-Reply-To: <CAG48ez0Y97-gyzWBmcVbUyLuzUG42To=Mm8PAKuzWma6XbFmew@mail.gmail.com>
On Fri, Jan 19, 2018 at 2:20 AM, Jann Horn <jannh@google.com> wrote:
>> + \
>> + __u._ptr = _arr + (_i & _mask); \
>> + __u._bit &= _mask; \
>
> AFAICS, if `idx` is out of bounds, you first zero out the index
> (`_i & _mask`) and then immediately afterwards zero out
> the whole pointer (`_u._bit &= _mask`).
> Is there a reason for the `_i & _mask`, and if so, can you
> add a comment explaining that?
I think that's just leftovers from my original (untested) thing that
also did the access itself. So that __u._bit masking wasn't masking
the pointer, it was masking the value that was *read* from the
pointer, so that you could know that an invalid access returned
0/NULL, not just the first value in the array.
Linus
next prev parent reply other threads:[~2018-01-19 18:18 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-01-19 0:01 [PATCH v4 00/10] prevent bounds-check bypass via speculative execution Dan Williams
2018-01-19 0:01 ` Dan Williams
2018-01-19 0:01 ` [PATCH v4 01/10] Documentation: document array_ptr Dan Williams
2018-01-19 0:01 ` [PATCH v4 02/10] asm/nospec, array_ptr: sanitize speculative array de-references Dan Williams
2018-01-19 0:01 ` Dan Williams
2018-01-19 10:20 ` [kernel-hardening] " Jann Horn
2018-01-19 17:48 ` Adam Sampson
2018-01-19 17:48 ` Adam Sampson
2018-01-19 18:12 ` Dan Williams
2018-01-19 18:18 ` Will Deacon
2018-01-19 18:18 ` [kernel-hardening] " Will Deacon
2018-01-19 18:26 ` Dan Williams
2018-01-19 18:18 ` Linus Torvalds [this message]
2018-01-19 18:18 ` Linus Torvalds
2018-01-19 20:55 ` Dan Williams
2018-01-25 7:09 ` Cyril Novikov
2018-01-25 7:09 ` Cyril Novikov
2018-01-25 22:37 ` Dan Williams
2018-01-25 22:37 ` Dan Williams
2018-01-19 0:01 ` [PATCH v4 03/10] x86: implement array_ptr_mask() Dan Williams
2018-01-19 0:01 ` [PATCH v4 04/10] x86: introduce __uaccess_begin_nospec and ifence Dan Williams
2018-01-19 0:02 ` [PATCH v4 05/10] x86, __get_user: use __uaccess_begin_nospec Dan Williams
2018-01-19 0:02 ` Dan Williams
2018-01-19 0:02 ` [PATCH v4 06/10] x86, get_user: use pointer masking to limit speculation Dan Williams
2018-01-19 0:02 ` [PATCH v4 07/10] x86: narrow out of bounds syscalls to sys_read under speculation Dan Williams
2018-01-24 14:40 ` Jiri Slaby
2018-02-06 19:29 ` Luis Henriques
2018-02-06 19:48 ` Dan Williams
2018-02-06 19:48 ` Dan Williams
2018-02-06 20:26 ` Linus Torvalds
2018-02-06 20:26 ` Linus Torvalds
2018-02-06 20:37 ` Dan Williams
2018-02-06 20:42 ` Linus Torvalds
2018-02-06 20:42 ` Linus Torvalds
2018-02-06 20:43 ` Linus Torvalds
2018-02-06 20:43 ` Linus Torvalds
2018-02-06 20:49 ` Andy Lutomirski
2018-02-06 20:49 ` Andy Lutomirski
2018-02-06 20:58 ` Linus Torvalds
2018-02-06 20:58 ` Linus Torvalds
2018-02-06 21:37 ` Dan Williams
2018-02-06 22:52 ` Linus Torvalds
2018-02-06 22:52 ` Linus Torvalds
2018-02-07 0:33 ` Dan Williams
2018-02-07 1:23 ` Linus Torvalds
2018-02-06 22:51 ` Luis Henriques
2018-02-06 22:51 ` Luis Henriques
2018-01-19 0:02 ` [PATCH v4 08/10] vfs, fdtable: prevent bounds-check bypass via speculative execution Dan Williams
2018-01-19 0:02 ` Dan Williams
2018-01-19 0:02 ` [PATCH v4 09/10] kvm, x86: fix spectre-v1 mitigation Dan Williams
2018-01-19 0:02 ` Dan Williams
2018-01-19 8:42 ` Paolo Bonzini
2018-01-19 8:42 ` Paolo Bonzini
[not found] ` <151632009605.21271.11304291057104672116.stgit-p8uTFz9XbKj2zm6wflaqv1nYeNYlB/vhral2JQCrhuEAvxtiuMwx3w@public.gmane.org>
2018-01-19 0:02 ` [PATCH v4 10/10] nl80211: sanitize array index in parse_txq_params Dan Williams
2018-01-19 0:02 ` Dan Williams
2018-01-21 10:37 ` Johannes Berg
2018-01-20 6:58 ` [PATCH v4 00/10] prevent bounds-check bypass via speculative execution Dan Williams
2018-01-20 6:58 ` Dan Williams
2018-01-20 16:56 ` Alexei Starovoitov
2018-01-20 16:56 ` Alexei Starovoitov
2018-01-20 17:07 ` Alexei Starovoitov
2018-01-20 17:07 ` Alexei Starovoitov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CA+55aFw-RNg4diZ0RCVkEYAANDp22YDskNOR913vKQEBdarJSw@mail.gmail.com \
--to=torvalds@linux-foundation.org \
--cc=akpm@linux-foundation.org \
--cc=alan@linux.intel.com \
--cc=catalin.marinas@arm.com \
--cc=dan.j.williams@intel.com \
--cc=gregkh@linuxfoundation.org \
--cc=hpa@zytor.com \
--cc=jannh@google.com \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=mingo@redhat.com \
--cc=tglx@linutronix.de \
--cc=will.deacon@arm.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).