Patch "nospec: Move array_index_nospec() parameter checking into separate macro" has been added to the 4.15-stable tree
This is a note to let you know that I've just added the patch titled
nospec: Move array_index_nospec() parameter checking into separate macro
to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
nospec-move-array_index_nospec-parameter-checking-into-separate-macro.patch
and it can be found in the queue-4.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.
Quoted 1 line
From
8fa80c503b484ddc1abbd10c7cb2ab81f3824a50Mon Sep 17 00:00:00 2001
From: Will Deacon <[email protected]>
Date: Mon, 5 Feb 2018 14:16:06 +0000
Subject: nospec: Move array_index_nospec() parameter checking into separate macro
From: Will Deacon <[email protected]>
commit 8fa80c503b484ddc1abbd10c7cb2ab81f3824a50 upstream.
For architectures providing their own implementation of array_index_mask_nospec() in asm/barrier.h, attempting to use WARN_ONCE() to complain about out-of-range parameters using WARN_ON() results in a mess of mutually-dependent include files.
Rather than unpick the dependencies, simply have the core code in nospec.h perform the checking for us.
--- include/linux/nospec.h | 36 +++++++++++++++++++++--------------- 1 file changed, 21 insertions(+), 15 deletions(-)
include/linux/nospec.h +21 -15
@@ -20,20 +20,6 @@ static inline unsigned long array_index_ unsigned long size) {/* -* Warn developers about inappropriate array_index_nospec() usage. -* -* Even if the CPU speculates past the WARN_ONCE branch, the -* sign bit of @index is taken into account when generating the -* mask. -* -* This warning is compiled out when the compiler can infer that -* @index and @size are less than LONG_MAX. -*/ -if (WARN_ONCE (index >LONG_MAX || size >LONG_MAX , -"array_index_nospec() limited to range of [0, LONG_MAX]\n" )) -return 0 ; - -/* * Always calculate and emit the mask even if the compiler * thinks the mask is not needed. The compiler does not take * into account the value of @index under speculation.
@@ -44,6 +30,26 @@ static inline unsigned long array_index_#endif /* +* Warn developers about inappropriate array_index_nospec() usage. +* +* Even if the CPU speculates past the WARN_ONCE branch, the +* sign bit of @index is taken into account when generating the +* mask. +* +* This warning is compiled out when the compiler can infer that +* @index and @size are less than LONG_MAX. +*/ +#define array_index_mask_nospec_check (index, size) \ +({ \ + if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ + "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ + _mask = 0; \ + else \ + _mask = array_index_mask_nospec(index, size); \ + _mask; \ +}) + +/* * array_index_nospec - sanitize an array index after a bounds check * * For a code sequence like:
@@ -61,7 +67,7 @@ static inline unsigned long array_index_ ({ \ typeof(index) _i = (index); \ typeof(size) _s = (size); \ - unsigned long _mask = array_index_mask_nospec(_i, _s); \ + unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ \ BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \
Patches currently in stable-queue which might be from [email protected] are
queue-4.15/nospec-move-array_index_nospec-parameter-checking-into-separate-macro.patch queue-4.15/x86-mm-rename-flush_tlb_single-and-flush_tlb_one-to-__flush_tlb_one_.patch