arm64: uaccess: Prevent speculative use of the current addr_limit

Web:        https://git.kernel.org/torvalds/c/c2f0ad4fc089cff81cef6a13d04b399980ecbfcc
Commit:     c2f0ad4fc089cff81cef6a13d04b399980ecbfcc
Parent:     6314d90e64936c584f300a52ef173603fb2461b5
Refname:    refs/heads/master
Author:     Will Deacon <[email protected]>
AuthorDate: Mon Feb 5 15:34:21 2018 +0000
Committer:  Catalin Marinas <[email protected]>
CommitDate: Tue Feb 6 22:53:37 2018 +0000

    arm64: uaccess: Prevent speculative use of the current addr_limit
    
    A mispredicted conditional call to set_fs could result in the wrong
    addr_limit being forwarded under speculation to a subsequent access_ok
    check, potentially forming part of a spectre-v1 attack using uaccess
    routines.
    
    This patch prevents this forwarding from taking place, but putting heavy
    barriers in set_fs after writing the addr_limit.
    
    Reviewed-by: Mark Rutland <[email protected]>
    Signed-off-by: Will Deacon <[email protected]>
    Signed-off-by: Catalin Marinas <[email protected]>
---
 arch/arm64/include/asm/uaccess.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index e49fe723d72d..2057deed7697 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -42,6 +42,13 @@ static inline void set_fs(mm_segment_t fs)
 {
 	current_thread_info()->addr_limit = fs;
 
+	/*
+	 * Prevent a mispredicted conditional call to set_fs from forwarding
+	 * the wrong address limit to access_ok under speculation.
+	 */
+	dsb(nsh);
+	isb();
+
 	/* On user-mode return, check fs is correct */
 	set_thread_flag(TIF_FSCHECK);
 
--
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [email protected]
More majordomo info at  http://vger.kernel.org/majordomo-info.html