Date: Fri, 12 Jan 2018 12:58:15 -0600
From: Josh Poimboeuf <jpoimboe@redhat.com>
To: Dan Williams <dan.j.williams@intel.com>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        linux-arch@vger.kernel.org, Andi Kleen <ak@linux.intel.com>,
        Kees Cook <keescook@chromium.org>,
        kernel-hardening@lists.openwall.com, X86 ML <x86@kernel.org>,
        Ingo Molnar <mingo@redhat.com>,
        Al Viro <viro@zeniv.linux.org.uk>,
        "H. Peter Anvin" <hpa@zytor.com>,
        Thomas Gleixner <tglx@linutronix.de>,
        Linus Torvalds <torvalds@linux-foundation.org>,
        Andrew Morton <akpm@linux-foundation.org>,
        Alan Cox <alan@linux.intel.com>
Subject: Re: [PATCH v2 07/19] x86: introduce __uaccess_begin_nospec and
 ASM_IFENCE
Message-ID: <20180112185815.meiwnnb5vmnrbsdt@treble>
References: <151571798296.27429.7166552848688034184.stgit@dwillia2-desk3.amr.corp.intel.com>
 <151571802258.27429.932636277047687877.stgit@dwillia2-desk3.amr.corp.intel.com>
 <20180112175109.yoz4jaaipztdj34k@treble>
 <CAPcyv4heW2FqxpCa0NZeTsa5V7pgpzA-MdHYJA+y9C5L2GTP9w@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <CAPcyv4heW2FqxpCa0NZeTsa5V7pgpzA-MdHYJA+y9C5L2GTP9w@mail.gmail.com>
User-Agent: Mutt/1.6.0.1 (2016-04-01)
Sender: linux-kernel-owner@vger.kernel.org

On Fri, Jan 12, 2018 at 10:21:43AM -0800, Dan Williams wrote:
> > That just sounds wrong.  What if the speculation starts *after* the
> > access_ok() check?  Then the barrier has no purpose.
> >
> > Most access_ok/get_user/copy_from_user calls are like this:
> >
> >   if (copy_from_user(...uptr..))  /* or access_ok() or get_user() */
> >         return -EFAULT;
> >
> > So in other words, the usercopy function is called *before* the branch.
> >
> > But to halt speculation, the lfence needs to come *after* the branch.
> > So putting lfences *before* the branch doesn't solve anything.
> >
> > So what am I missing?
> 
> We're trying to prevent a pointer under user control from being
> de-referenced inside the kernel, before we know it has been limited to
> something safe. In the following sequence the branch we are worried
> about speculating is the privilege check:
> 
> if (access_ok(uptr))  /* <--- Privelege Check */
>     if (copy_from_user_(uptr))
> 
> The cpu can speculatively skip that access_ok() check and cause a read
> of kernel memory.

Converting your example code to assembly:

	call	access_ok # no speculation which started before this point is allowed to continue past this point
	test	%rax, %rax
	jne	error_path
dereference_uptr:
	(do nefarious things with the user pointer)

error_path:
	mov -EINVAL, %rax
	ret

So the CPU is still free to speculately execute the dereference_uptr
block because the lfence was before the 'jne error_path' branch.

-- 
Josh