Dave Hansen 3b6ce54cfa uaccess: Add speculation barrier to copy_from_user()
commit 74e19ef0ff8061ef55957c3abd71614ef0f42f47 upstream.

The results of "access_ok()" can be mis-speculated.  The result is that
you can end speculatively:

	if (access_ok(from, size))
		// Right here

even for bad from/size combinations.  On first glance, it would be ideal
to just add a speculation barrier to "access_ok()" so that its results
can never be mis-speculated.

But there are lots of system calls just doing access_ok() via
"copy_to_user()" and friends (example: fstat() and friends).  Those are
generally not problematic because they do not _consume_ data from
userspace other than the pointer.  They are also very quick and common
system calls that should not be needlessly slowed down.

"copy_from_user()" on the other hand uses a user-controller pointer and
is frequently followed up with code that might affect caches.  Take
something like this:

	if (!copy_from_user(&kernelvar, uptr, size))
		do_something_with(kernelvar);

If userspace passes in an evil 'uptr' that *actually* points to a kernel
addresses, and then do_something_with() has cache (or other)
side-effects, it could allow userspace to infer kernel data values.

Add a barrier to the common copy_from_user() code to prevent
mis-speculated values which happen after the copy.

Also add a stub for architectures that do not define barrier_nospec().
This makes the macro usable in generic code.

Since the barrier is now usable in generic code, the x86 #ifdef in the
BPF code can also go away.

Reported-by: Jordy Zomer <jordyzomer@google.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>   # BPF bits
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-02-25 11:55:03 +01:00
..
2022-12-02 17:40:03 +01:00
2022-08-21 15:16:16 +02:00
2020-10-17 11:18:18 -07:00
2023-02-01 08:23:19 +01:00
2022-10-26 13:25:35 +02:00
2020-09-21 15:00:40 -07:00
2020-10-02 15:00:49 -07:00
2020-10-16 17:21:51 +02:00
2020-10-13 15:58:10 -07:00
2020-10-19 14:28:30 -07:00
2022-07-07 17:52:17 +02:00
2023-01-14 10:16:47 +01:00
2020-10-15 14:43:29 -07:00
2022-10-26 13:25:42 +02:00
2020-09-16 08:54:53 -05:00
2022-04-13 21:00:56 +02:00
2020-11-19 22:38:29 -05:00
2020-10-13 18:38:32 -07:00
2021-03-04 11:37:59 +01:00
2022-08-21 15:16:08 +02:00
2021-02-07 15:37:17 +01:00
2021-11-18 14:03:37 +01:00
2022-08-21 15:15:21 +02:00
2021-06-30 08:47:26 -04:00
2023-01-04 11:39:16 +01:00
2020-10-07 14:28:39 -04:00
2020-10-17 11:18:18 -07:00
2021-03-30 14:32:05 +02:00
2020-10-18 09:27:10 -07:00
2020-10-14 16:09:32 -07:00
2023-01-04 11:39:23 +01:00
2020-09-26 22:55:05 -04:00
2021-05-07 11:04:32 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:18 +02:00
2021-05-14 09:50:31 +02:00
2020-09-10 14:03:31 -07:00
2020-10-05 13:21:49 +02:00
2020-10-20 14:39:37 -07:00