From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x2258pFNgZhBaMZcOcJLZcZ2Mt6guKu+KkxDLmRczPbrxy0oxWAbHaue8kqGG5lutEWedEEx/ ARC-Seal: i=1; a=rsa-sha256; t=1519218169; cv=none; d=google.com; s=arc-20160816; b=RqnjKfrqrp/IoislthK1JrDeqTl71gjXitm7LLGNmY8AqfNQbQtwfuOsiaUNh4V85w bl5bd4kUTYf87nTUxwbZUD1BRmHTiHM8/9kHdQhsI+tpNczdfqNNlU6a05GYN08xm3d+ 8UaQWUH9FPV68Fowck56SwPi8+SktynktpM5pWKlMt7dfr5Md2PcMdXtFjrLxrNthtKb ONXLXu9Zte7LC3jGBSknnC6TMDI4P3ALDxrPxp+oslIA6OsmHmZbdKUg/sNY4UqI8yAg 0w827znKSA/+7xn9nO3qamIDMShFY1EzFWGpH7HPuNvx46G1NldSndyjn8/gPT3Z8+Ld fYaA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=OYVBMF6RGmltyvr5vsPGTkiMrrlhBjzQGlGm3F0OfoI=; b=jfmVdv35TKEnj9/K3273bCaJuPxFEOFWBVMwPGb4mCRVDooszahF+7GBfknC+e2nDT 4Htc25Ceg6nofcBEmGHVr9gJvgD8UmUkX5Nj4Ilwk3/DBlOM6/BqKOqr4E6G181IkMFi nCu2h/vgW9g+Tv/YiBay794wRTQSf/ViVEFz3JIMCtrDr3CfylbX6n7aufeU0YihyUYh zZL7fVR0F6xxn1yafPmo5HYFFU+ROShAo48COAuG97Fe5yPYL/0IgADjJu79ZLYNMJsq 8TxqGp6Wp32jbSoqLpWNOxHs9zcQtrnVw8FN+2BReYxN+FXB+Eet5lk2JEYugh9WzmhM KKlA== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Will Deacon , Thomas Gleixner , Dan Williams , Linus Torvalds , Peter Zijlstra , Ingo Molnar Subject: [PATCH 4.14 077/167] nospec: Move array_index_nospec() parameter checking into separate macro Date: Wed, 21 Feb 2018 13:48:08 +0100 Message-Id: <20180221124528.681007734@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180221124524.639039577@linuxfoundation.org> References: <20180221124524.639039577@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1593015327190817338?= X-GMAIL-MSGID: =?utf-8?q?1593015711093416268?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Will Deacon commit 8fa80c503b484ddc1abbd10c7cb2ab81f3824a50 upstream. For architectures providing their own implementation of array_index_mask_nospec() in asm/barrier.h, attempting to use WARN_ONCE() to complain about out-of-range parameters using WARN_ON() results in a mess of mutually-dependent include files. Rather than unpick the dependencies, simply have the core code in nospec.h perform the checking for us. Signed-off-by: Will Deacon Acked-by: Thomas Gleixner Cc: Dan Williams Cc: Linus Torvalds Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1517840166-15399-1-git-send-email-will.deacon@arm.com Signed-off-by: Ingo Molnar Signed-off-by: Greg Kroah-Hartman --- include/linux/nospec.h | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-) --- a/include/linux/nospec.h +++ b/include/linux/nospec.h @@ -20,20 +20,6 @@ static inline unsigned long array_index_ unsigned long size) { /* - * Warn developers about inappropriate array_index_nospec() usage. - * - * Even if the CPU speculates past the WARN_ONCE branch, the - * sign bit of @index is taken into account when generating the - * mask. - * - * This warning is compiled out when the compiler can infer that - * @index and @size are less than LONG_MAX. - */ - if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, - "array_index_nospec() limited to range of [0, LONG_MAX]\n")) - return 0; - - /* * Always calculate and emit the mask even if the compiler * thinks the mask is not needed. The compiler does not take * into account the value of @index under speculation. @@ -44,6 +30,26 @@ static inline unsigned long array_index_ #endif /* + * Warn developers about inappropriate array_index_nospec() usage. + * + * Even if the CPU speculates past the WARN_ONCE branch, the + * sign bit of @index is taken into account when generating the + * mask. + * + * This warning is compiled out when the compiler can infer that + * @index and @size are less than LONG_MAX. + */ +#define array_index_mask_nospec_check(index, size) \ +({ \ + if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ + "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ + _mask = 0; \ + else \ + _mask = array_index_mask_nospec(index, size); \ + _mask; \ +}) + +/* * array_index_nospec - sanitize an array index after a bounds check * * For a code sequence like: @@ -61,7 +67,7 @@ static inline unsigned long array_index_ ({ \ typeof(index) _i = (index); \ typeof(size) _s = (size); \ - unsigned long _mask = array_index_mask_nospec(_i, _s); \ + unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ \ BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \