Messages in this thread | | | Date | Tue, 24 Apr 2018 13:21:29 +0200 | From | Peter Zijlstra <> | Subject | Re: [PATCH 01/11] media: tm6000: fix potential Spectre variant 1 |
| |
On Tue, Apr 24, 2018 at 12:36:09PM +0200, Peter Zijlstra wrote: > > Then usespace probes which part of the descr[] array is now in cache and > from that it can infer the initial out-of-bound value.
Just had a better look at v4l_fill_fmtdesc() and actually read the comment. The code cannot be compiled as a array because it is big and sparse. But the log(n) condition tree is a prime candidate for the branchscope side-channel, which would be able to reconstruct a significant number of bits of the original value. A denser tree gives more bits etc.
| |