On Fri, Jan 12, 2018 at 12:01:04PM -0800, Linus Torvalds wrote: > On Fri, Jan 12, 2018 at 11:26 AM, Dan Williams <dan.j.williams@xxxxxxxxx> wrote: > > > > By the time we get to de-reference uptr we know it is not pointing at > > kernel memory, because access_ok would have failed and the cpu would > > have waited for that failure result before doing anything else. > > I'm not actually convinced that's right in the original patches, > exactly because of the issue that Josh pointed out: even if there is a > comparison inside access_ok() that will be properly serialized, then > that comparison can (and sometimes does) just cause a truth value to > be generated, and then there might be *another* comparison of that > return value after the lfence. And while the return value is table, > the conditional branch on that comparison isn't. > > The new model of just doing it together with the STAC should be fine, though. Aha, that clears it up for me, thanks. I was still thinking about the previous version of the patch which had the barrier in access_ok(). I didn't realize the new version moved the barrier to after the access_ok() checks. -- Josh
