queue-4.14/powerpc-use-barrier_nospec-in-copy_from_user.patch

   1 From foo@baz Fri Mar 29 15:53:50 CET 2019
   2 From: Michael Ellerman <mpe@ellerman.id.au>
   3 Date: Fri, 29 Mar 2019 22:25:52 +1100
   4 Subject: powerpc: Use barrier_nospec in copy_from_user()
   5 To: stable@vger.kernel.org, gregkh@linuxfoundation.org
   6 Cc: linuxppc-dev@ozlabs.org, diana.craciun@nxp.com, msuchanek@suse.de, christophe.leroy@c-s.fr
   7 Message-ID: <20190329112620.14489-5-mpe@ellerman.id.au>
   8
   9 From: Michael Ellerman <mpe@ellerman.id.au>
  10
  11 commit ddf35cf3764b5a182b178105f57515b42e2634f8 upstream.
  12
  13 Based on the x86 commit doing the same.
  14
  15 See commit 304ec1b05031 ("x86/uaccess: Use __uaccess_begin_nospec()
  16 and uaccess_try_nospec") and b3bbfb3fb5d2 ("x86: Introduce
  17 __uaccess_begin_nospec() and uaccess_try_nospec") for more detail.
  18
  19 In all cases we are ordering the load from the potentially
  20 user-controlled pointer vs a previous branch based on an access_ok()
  21 check or similar.
  22
  23 Base on a patch from Michal Suchanek.
  24
  25 Signed-off-by: Michal Suchanek <msuchanek@suse.de>
  26 Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
  27 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  28 ---
  29  arch/powerpc/include/asm/uaccess.h |   11 ++++++++++-
  30  1 file changed, 10 insertions(+), 1 deletion(-)
  31
  32 --- a/arch/powerpc/include/asm/uaccess.h
  33 +++ b/arch/powerpc/include/asm/uaccess.h
  34 @@ -238,6 +238,7 @@ do {                                                                \
  35         __chk_user_ptr(ptr);                                    \
  36         if (!is_kernel_addr((unsigned long)__gu_addr))          \
  37                 might_fault();                                  \
  38 +       barrier_nospec();                                       \
  39         __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
  40         (x) = (__typeof__(*(ptr)))__gu_val;                     \
  41         __gu_err;                                               \
  42 @@ -249,8 +250,10 @@ do {                                                               \
  43         __long_type(*(ptr)) __gu_val = 0;                               \
  44         const __typeof__(*(ptr)) __user *__gu_addr = (ptr);             \
  45         might_fault();                                                  \
  46 -       if (access_ok(VERIFY_READ, __gu_addr, (size)))                  \
  47 +       if (access_ok(VERIFY_READ, __gu_addr, (size))) {                \
  48 +               barrier_nospec();                                       \
  49                 __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
  50 +       }                                                               \
  51         (x) = (__force __typeof__(*(ptr)))__gu_val;                             \
  52         __gu_err;                                                       \
  53  })
  54 @@ -261,6 +264,7 @@ do {                                                                \
  55         __long_type(*(ptr)) __gu_val;                           \
  56         const __typeof__(*(ptr)) __user *__gu_addr = (ptr);     \
  57         __chk_user_ptr(ptr);                                    \
  58 +       barrier_nospec();                                       \
  59         __get_user_size(__gu_val, __gu_addr, (size), __gu_err); \
  60         (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
  61         __gu_err;                                               \
  62 @@ -288,15 +292,19 @@ static inline unsigned long raw_copy_fro
  63
  64                 switch (n) {
  65                 case 1:
  66 +                       barrier_nospec();
  67                         __get_user_size(*(u8 *)to, from, 1, ret);
  68                         break;
  69                 case 2:
  70 +                       barrier_nospec();
  71                         __get_user_size(*(u16 *)to, from, 2, ret);
  72                         break;
  73                 case 4:
  74 +                       barrier_nospec();
  75                         __get_user_size(*(u32 *)to, from, 4, ret);
  76                         break;
  77                 case 8:
  78 +                       barrier_nospec();
  79                         __get_user_size(*(u64 *)to, from, 8, ret);
  80                         break;
  81                 }
  82 @@ -304,6 +312,7 @@ static inline unsigned long raw_copy_fro
  83                         return 0;
  84         }
  85
  86 +       barrier_nospec();
  87         return __copy_tofrom_user((__force void __user *)to, from, n);
  88  }
  89