Messages in this thread | | | Date | Fri, 23 Sep 2022 13:13:28 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH] x86: also disable FSRM if ERMS is disabled |
| |
On Thu, Sep 22, 2022 at 05:58:27PM -0700, Daniel Verkamp wrote: > In the "Fast Short REP MOVSB" path of memmove, if we take the path where > the FSRM flag is enabled but the ERMS flag is not, there is no longer a > check for length >= 0x20 (both alternatives will be replaced with NOPs). > If a memmove() requiring a forward copy of less than 0x20 bytes happens > in this case, the `sub $0x20, %rdx` will cause the length to roll around > to a huge value and the copy will eventually hit a page fault. > > This is not intended to happen, as the comment above the alternatives > mentions "FSRM implies ERMS". > > However, there is a check in early_init_intel() that can disable ERMS, > so we should also be disabling FSRM in this path to maintain correctness > of the memmove() optimization.
Is this something you hit in a real-world scenario? If so, how exactly?
Thx.
-- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |