RE: [Xen-devel] [PATCH] [v2] xen: hypercall: fix out-of-bounds memcpy

[David Laight]

From: Andrew Cooper
> Sent: 05 February 2018 15:14
> 
> On 05/02/18 15:03, Arnd Bergmann wrote:
> 
> Snipping deleted code to make things clearer:
> 
> > +	if (cmd > ARRAY_SIZE(physdevop_len))
> > +		return -ENOSYS;
> >
> > +	len = physdevop_len[cmd];
> > +	memcpy(&op.u, arg, len);
> 
> You'll want an array_nospec() or whatever its called these days. This
> code is SP1-leaky.
> 
> Userspace controls cmd and can retrieve len by timing how many adjacent
> cache lines were pulled in my memcpy().

Well, maybe it can read beyond the bounds of physdevop_len[].
I doubt that the memcpy() will pull in many cache lines so you
can probably only determine whether the value is 0..63, 64..127 or 128+
Not likely to be much use.

	David