On Wed, Jan 17, 2018 at 12:05 PM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
> On Wed, Jan 17, 2018 at 11:54:12AM -0800, Dan Williams wrote:
>> On Wed, Jan 17, 2018 at 10:52 AM, Al Viro <viro@xxxxxxxxxxxxxxxxxx> wrote:
>> > On Wed, Jan 17, 2018 at 02:17:26PM +0000, Alan Cox wrote:
>> [..]
>> > Incidentally, what about copy_to_iter() and friends? They
>> > check iov_iter flavour and go either into the "copy to kernel buffer"
>> > or "copy to userland" paths. Do we need to deal with mispredictions
>> > there? We are calling a bunch of those on read()...
>> >
>>
>> Those should be protected by the conversion of __uaccess_begin to
>> __uaccess_begin_nospec that includes the lfence.
>
> Huh? What the hell does it do to speculative execution of "memcpy those
> suckers" branch?
'raw_copy_from_user 'is changed to use 'uaccess_begin_nospec' instead
of plain 'uacess_begin'. The only difference between those being that
the former includes an lfence. So with this sequence.
if (access_ok(VERIFY_READ, from, n)) {
kasan_check_write(to, n);
n = raw_copy_from_user(to, from, n);
}
return n;
...'from' is guaranteed to be within the address limit with respect to
speculative execution, or otherwise never de-referenced.
