From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2A9DC43387 for ; Thu, 20 Dec 2018 17:35:50 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D0C4A218D4 for ; Thu, 20 Dec 2018 17:35:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387949AbeLTRft (ORCPT ); Thu, 20 Dec 2018 12:35:49 -0500 Received: from mx2.suse.de ([195.135.220.15]:47148 "EHLO mx1.suse.de" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S2387591AbeLTRfr (ORCPT ); Thu, 20 Dec 2018 12:35:47 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (unknown [195.135.220.254]) by mx1.suse.de (Postfix) with ESMTP id 97DF3ACC4; Thu, 20 Dec 2018 17:35:45 +0000 (UTC) Date: Thu, 20 Dec 2018 18:35:44 +0100 Message-ID: From: Takashi Iwai To: "Gustavo A. R. Silva" Cc: Jaroslav Kysela , alsa-devel@alsa-project.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] ALSA: isa/wavefront: Fix potential Spectre v1 vulnerabilities In-Reply-To: References: <20181219233143.GA14518@embeddedor> User-Agent: Wanderlust/2.15.9 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.9 (=?UTF-8?B?R29qxY0=?=) APEL/10.8 Emacs/26 (x86_64-suse-linux-gnu) MULE/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 20 Dec 2018 18:13:31 +0100, Gustavo A. R. Silva wrote: > > On 12/20/18 2:11 AM, Takashi Iwai wrote: > > On Thu, 20 Dec 2018 00:31:43 +0100, > > Gustavo A. R. Silva wrote: > >> > >> header->number is indirectly controlled by user-space, hence leading > >> to a potential exploitation of the Spectre variant 1 vulnerability. > >> > >> This issue was detected with the help of Smatch: > >> > >> sound/isa/wavefront/wavefront_synth.c:792 wavefront_send_patch() warn: potential spectre issue 'dev->patch_status' [w] (local cap) > >> sound/isa/wavefront/wavefront_synth.c:819 wavefront_send_program() warn: potential spectre issue 'dev->prog_status' [w] (local cap) > >> sound/isa/wavefront/wavefront_synth.c:1197 wavefront_send_alias() warn: potential spectre issue 'dev->sample_status' [w] > >> sound/isa/wavefront/wavefront_synth.c:1248 wavefront_send_multisample() warn: potential spectre issue 'dev->sample_status' [w] > >> sound/isa/wavefront/wavefront_synth.c:1548 wavefront_synth_control() warn: potential spectre issue 'dev->sample_status' [r] (local cap) > >> > >> Fix this by sanitizing header->number before using it to index > >> dev->patch_status, dev->prog_status and dev->sample_status. > >> > >> Notice that given that speculation windows are large, the policy is > >> to kill the speculation on the first load and not worry if it can be > >> completed with a dependent load/store [1]. > >> > >> [1] https://marc.info/?l=linux-kernel&m=152449131114778&w=2 > >> > >> Cc: stable@vger.kernel.org > >> Signed-off-by: Gustavo A. R. Silva > > > > Is there any platform with ISA slot that suffers from Spectre? > > > > > > Do you mean 'any other'? Well, no, my question is whether it makes sense to patch the code path for such ISA drivers. Spectre seems applicable since the model around 2006 or so, and ISA slot has been already dead for very long time. And yet with this minor board... I bet no one hits this in the world. thanks, Takashi