Re: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation

[Mark Rutland]

On Tue, Sep 01, 2020 at 09:21:58AM -0500, Josh Poimboeuf wrote:
> On Tue, Sep 01, 2020 at 03:02:08PM +0100, Mark Rutland wrote:
> > d instead do user pointer
> > > masking, throughout the x86 uaccess code.  This is similar to what arm64
> > > is already doing.
> > > 
> > > barrier_nospec() is now unused, and can be removed.
> > 
> > One thing to consider is whether you need a speculation barrier after
> > set_fs(). Otherwise for code like:
> > 
> > | fs = get_fs();
> > | if (cond)
> > |	set_fs(KERNEL_DS);
> > | copy_to_user(...)
> > | set_fs(fs)
> > 
> > ... the set_fs() can occur speculatively, and may be able to satisfy
> > the masking logic if forwarded within the cpu.
> > 
> > See arm64 commit:
> > 
> >   c2f0ad4fc089cff8 ("arm64: uaccess: Prevent speculative use of the current addr_limit")
> 
> Do you have any examples of that conditional set_fs(KERNEL_DS) pattern?
> I wasn't able to find any.

I'm afraid not -- we used to in arm64 in some memory dump code, but that
is now gone. It might be that this is no longer necessary.

If set_fs() goes entirely, that's even better...

Thanks,
Mark.