lkml.org 
[lkml]   [2018]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH 10/18] qla2xxx: prevent bounds-check bypass via speculative execution
    On Fri, Jan 05, 2018 at 05:10:48PM -0800, Dan Williams wrote:
    > Static analysis reports that 'handle' may be a user controlled value
    > that is used as a data dependency to read 'sp' from the
    > 'req->outstanding_cmds' array. In order to avoid potential leaks of
    > kernel memory values, block speculative execution of the instruction
    > stream that could issue reads based on an invalid value of 'sp'. In this
    > case 'sp' is directly dereferenced later in the function.

    I'm pretty sure that 'handle' comes from the hardware, not from
    userspace, from what I can tell here. If we want to start auditing
    __iomem data sources, great! But that's a bigger task, and one I don't
    think we are ready to tackle...

    thanks,

    greg k-h

    \
     
     \ /
      Last update: 2018-01-06 10:04    [W:5.206 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site