| From 1d91c1d2c80cb70e2e553845e278b87a960c04da Mon Sep 17 00:00:00 2001 |
| From: Dan Williams <dan.j.williams@intel.com> |
| Date: Fri, 16 Feb 2018 13:20:42 -0800 |
| Subject: nospec: Kill array_index_nospec_mask_check() |
| |
| From: Dan Williams <dan.j.williams@intel.com> |
| |
| commit 1d91c1d2c80cb70e2e553845e278b87a960c04da upstream. |
| |
| There are multiple problems with the dynamic sanity checking in |
| array_index_nospec_mask_check(): |
| |
| * It causes unnecessary overhead in the 32-bit case since integer sized |
| @index values will no longer cause the check to be compiled away like |
| in the 64-bit case. |
| |
| * In the 32-bit case it may trigger with user controllable input when |
| the expectation is that should only trigger during development of new |
| kernel enabling. |
| |
| * The macro reuses the input parameter in multiple locations which is |
| broken if someone passes an expression like 'index++' to |
| array_index_nospec(). |
| |
| Reported-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Dan Williams <dan.j.williams@intel.com> |
| Cc: Andy Lutomirski <luto@kernel.org> |
| Cc: Arjan van de Ven <arjan@linux.intel.com> |
| Cc: Borislav Petkov <bp@alien8.de> |
| Cc: Dave Hansen <dave.hansen@linux.intel.com> |
| Cc: David Woodhouse <dwmw2@infradead.org> |
| Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Cc: Josh Poimboeuf <jpoimboe@redhat.com> |
| Cc: Peter Zijlstra <peterz@infradead.org> |
| Cc: Thomas Gleixner <tglx@linutronix.de> |
| Cc: Will Deacon <will.deacon@arm.com> |
| Cc: linux-arch@vger.kernel.org |
| Link: http://lkml.kernel.org/r/151881604278.17395.6605847763178076520.stgit@dwillia2-desk3.amr.corp.intel.com |
| Signed-off-by: Ingo Molnar <mingo@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| include/linux/nospec.h | 22 +--------------------- |
| 1 file changed, 1 insertion(+), 21 deletions(-) |
| |
| --- a/include/linux/nospec.h |
| +++ b/include/linux/nospec.h |
| @@ -30,26 +30,6 @@ static inline unsigned long array_index_ |
| #endif |
| |
| /* |
| - * Warn developers about inappropriate array_index_nospec() usage. |
| - * |
| - * Even if the CPU speculates past the WARN_ONCE branch, the |
| - * sign bit of @index is taken into account when generating the |
| - * mask. |
| - * |
| - * This warning is compiled out when the compiler can infer that |
| - * @index and @size are less than LONG_MAX. |
| - */ |
| -#define array_index_mask_nospec_check(index, size) \ |
| -({ \ |
| - if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ |
| - "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ |
| - _mask = 0; \ |
| - else \ |
| - _mask = array_index_mask_nospec(index, size); \ |
| - _mask; \ |
| -}) |
| - |
| -/* |
| * array_index_nospec - sanitize an array index after a bounds check |
| * |
| * For a code sequence like: |
| @@ -67,7 +47,7 @@ static inline unsigned long array_index_ |
| ({ \ |
| typeof(index) _i = (index); \ |
| typeof(size) _s = (size); \ |
| - unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ |
| + unsigned long _mask = array_index_mask_nospec(_i, _s); \ |
| \ |
| BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ |
| BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ |