From: Josh Poimboeuf Subject: Re: [PATCH v2] ext4: mballoc: Fix spectre gadget in ext4_mb_regular_allocator Date: Mon, 30 Jul 2018 13:54:08 -0500 Message-ID: <20180730185408.hl6omiitkqpac5d3@treble> References: <20180730180747.25200-1-jcline@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8 Cc: Theodore Ts'o , Andreas Dilger , linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org To: Jeremy Cline Return-path: Content-Disposition: inline In-Reply-To: <20180730180747.25200-1-jcline@redhat.com> Sender: stable-owner@vger.kernel.org List-Id: linux-ext4.vger.kernel.org On Mon, Jul 30, 2018 at 06:07:47PM +0000, Jeremy Cline wrote: > 'ac->ac_g_ex.fe_len' is a user-controlled value which is used in the > derivation of 'ac->ac_2order'. 'ac->ac_2order', in turn, is used to > index arrays which makes it a potential spectre gadget. Fix this by > sanitizing the value assigned to 'ac->ac2_order'. This covers the > following accesses found with the help of smatch: > > * fs/ext4/mballoc.c:1896 ext4_mb_simple_scan_group() warn: potential > spectre issue 'grp->bb_counters' [w] (local cap) > > * fs/ext4/mballoc.c:445 mb_find_buddy() warn: potential spectre issue > 'EXT4_SB(e4b->bd_sb)->s_mb_offsets' [r] (local cap) > > * fs/ext4/mballoc.c:446 mb_find_buddy() warn: potential spectre issue > 'EXT4_SB(e4b->bd_sb)->s_mb_maxs' [r] (local cap) > > Cc: Josh Poimboeuf > Cc: stable@vger.kernel.org > Suggested-by: Josh Poimboeuf > Signed-off-by: Jeremy Cline Reviewed-by: Josh Poimboeuf -- Josh