RE: [PATCH] x86/uaccess: Use pointer masking to limit uaccess speculation

[David Laight <David.Laight@ACULAB.COM>]

From: Josh Poimboeuf
> Sent: 31 August 2020 18:31
> On Sat, Aug 29, 2020 at 07:31:20PM +0000, David Laight wrote:
> > > Rereading the patch it looks like a lot of bloat (as well as a
> > > lot of changes).
> > > Does the array_mask even work on 32bit archs where the kernel
> > > base address is 0xc0000000?
> 
> Why wouldn't it on work on 32-bit?  My patch does have a minor compile
> bug on 32-bit, but otherwise it seems to work (i.e., the asm looks ok,
> and it boots).

As usual I hadn't looked closely enough into the masked_array internals.

...
> > Actually, thinking further, if:
> > 1) the access_ok() immediately precedes the user copy (as it should).
> > 2) the user-copies use a sensible 'increasing address' copy.
> > and
> > 3) there is a 'guard page' between valid user and kernel addresses.
> > Then access_ok() only need check the base address of the user buffer.
> 
> Yes, it would make sense to put the masking in access_ok() somehow.  But
> to do it properly, I think we'd first need to make access_ok() generic.
> Maybe that's do-able, but it would be a much bigger patch set.
> 
> First I'd prefer to just fix x86, like my patch does.  Then we could do
> an access_ok() rework.

If you do a modified access_ok() you get to (slowly) collect all
the important paths.
No point replicating the same test.

A lot of the access_ok() can be deleted - maybe remove some __
from the following functions.
Or change to the variants that enable user-space accesses.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)