Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965244AbeALUlc (ORCPT + 1 other); Fri, 12 Jan 2018 15:41:32 -0500 Received: from mx1.redhat.com ([209.132.183.28]:42114 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965188AbeALUl3 (ORCPT ); Fri, 12 Jan 2018 15:41:29 -0500 Date: Fri, 12 Jan 2018 14:41:26 -0600 From: Josh Poimboeuf To: Linus Torvalds Cc: Dan Williams , Linux Kernel Mailing List , linux-arch@vger.kernel.org, Andi Kleen , Kees Cook , kernel-hardening@lists.openwall.com, X86 ML , Ingo Molnar , Al Viro , "H. Peter Anvin" , Thomas Gleixner , Andrew Morton , Alan Cox Subject: Re: [PATCH v2 07/19] x86: introduce __uaccess_begin_nospec and ASM_IFENCE Message-ID: <20180112204126.257jubn2hccgtzdt@treble> References: <151571798296.27429.7166552848688034184.stgit@dwillia2-desk3.amr.corp.intel.com> <151571802258.27429.932636277047687877.stgit@dwillia2-desk3.amr.corp.intel.com> <20180112175109.yoz4jaaipztdj34k@treble> <20180112185815.meiwnnb5vmnrbsdt@treble> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Fri, 12 Jan 2018 20:41:29 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Fri, Jan 12, 2018 at 12:01:04PM -0800, Linus Torvalds wrote: > On Fri, Jan 12, 2018 at 11:26 AM, Dan Williams wrote: > > > > By the time we get to de-reference uptr we know it is not pointing at > > kernel memory, because access_ok would have failed and the cpu would > > have waited for that failure result before doing anything else. > > I'm not actually convinced that's right in the original patches, > exactly because of the issue that Josh pointed out: even if there is a > comparison inside access_ok() that will be properly serialized, then > that comparison can (and sometimes does) just cause a truth value to > be generated, and then there might be *another* comparison of that > return value after the lfence. And while the return value is table, > the conditional branch on that comparison isn't. > > The new model of just doing it together with the STAC should be fine, though. Aha, that clears it up for me, thanks. I was still thinking about the previous version of the patch which had the barrier in access_ok(). I didn't realize the new version moved the barrier to after the access_ok() checks. -- Josh