From nobody Thu Oct 9 02:57:40 2025 Received: from pegase1.c-s.fr (pegase1.c-s.fr [93.17.236.30]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 205B11422AB; Sun, 22 Jun 2025 10:20:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=93.17.236.30 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750587636; cv=none; b=fLN7i4BdVzL+UoPwMMxz0iYh44Aacvgw+n2GZoX91yUnF5yLW0650P+m4nFuseqXBXmjEMsUGHOtPeiGGOgSA0sMe653M20yYHuFK9BAMSqmTZfN5ooHGoUfRwDQBkf954T/HJcnvJCbkP5VsOaVg9Y0j6VpvpokrKCQpxBfWRA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1750587636; c=relaxed/simple; bh=UYxQJS6ZJHCmE3zbSwM0x0YAEUS01DTZiXJZEvopO2E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=j4gaoou2pGk97zYSIgdAyBQ7pTpxAcEGkE5e4AZxdGixCA8RPzuHw2FUFFASAp3I1y81bH1VgbrqP7QWyBtnO2x4uopd2XSrVpn9PFu/vRTVgUG7Sk3w8r6JOxsDVYBOSHXmp/dfCdMRLaj1xUN4pFpwjLt98k1M3FIkZxekMtk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu; spf=pass smtp.mailfrom=csgroup.eu; arc=none smtp.client-ip=93.17.236.30 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=csgroup.eu Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=csgroup.eu Received: from localhost (mailhub3.si.c-s.fr [192.168.12.233]) by localhost (Postfix) with ESMTP id 4bQ62q2tJCz9sbF; Sun, 22 Jun 2025 11:52:51 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from pegase1.c-s.fr ([192.168.12.234]) by localhost (pegase1.c-s.fr [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id OYHyRMeMBap9; Sun, 22 Jun 2025 11:52:51 +0200 (CEST) Received: from messagerie.si.c-s.fr (messagerie.si.c-s.fr [192.168.25.192]) by pegase1.c-s.fr (Postfix) with ESMTP id 4bQ62q20ksz9sXD; Sun, 22 Jun 2025 11:52:51 +0200 (CEST) Received: from localhost (localhost [127.0.0.1]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 3CD248B764; Sun, 22 Jun 2025 11:52:51 +0200 (CEST) X-Virus-Scanned: amavisd-new at c-s.fr Received: from messagerie.si.c-s.fr ([127.0.0.1]) by localhost (messagerie.si.c-s.fr [127.0.0.1]) (amavisd-new, port 10023) with ESMTP id ItRVmE4jH7_E; Sun, 22 Jun 2025 11:52:51 +0200 (CEST) Received: from PO20335.idsi0.si.c-s.fr (unknown [192.168.235.99]) by messagerie.si.c-s.fr (Postfix) with ESMTP id 4E5C18B763; Sun, 22 Jun 2025 11:52:50 +0200 (CEST) From: Christophe Leroy To: Michael Ellerman , Nicholas Piggin , Naveen N Rao , Madhavan Srinivasan , Alexander Viro , Christian Brauner , Jan Kara , Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Darren Hart , Davidlohr Bueso , "Andre Almeida" , Andrew Morton , David Laight , Dave Hansen , Linus Torvalds Cc: Christophe Leroy , linux-kernel@vger.kernel.org, linuxppc-dev@lists.ozlabs.org, linux-fsdevel@vger.kernel.org, linux-mm@kvack.org Subject: [PATCH 2/5] uaccess: Add speculation barrier to copy_from_user_iter() Date: Sun, 22 Jun 2025 11:52:40 +0200 Message-ID: X-Mailer: git-send-email 2.49.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1750585958; l=1183; i=christophe.leroy@csgroup.eu; s=20211009; h=from:subject:message-id; bh=UYxQJS6ZJHCmE3zbSwM0x0YAEUS01DTZiXJZEvopO2E=; b=CZDMdcFmnufRcPRhMzoZv84scqPZFsLBFe6GrnY1YvrDPqC/h/DYWJVikSKeIb35hKqIXPgrn /bJG+wBOUX6CLrIA00TjhTQhNdgXy5elmLQw6y5gHEPFOZkqvKJl1vx X-Developer-Key: i=christophe.leroy@csgroup.eu; a=ed25519; pk=HIzTzUj91asvincQGOFx6+ZF5AoUuP9GdOtQChs7Mm0= Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The results of "access_ok()" can be mis-speculated. The result is that you can end speculatively: if (access_ok(from, size)) // Right here For the same reason as done in copy_from_user() by commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()"), add a speculation barrier to copy_from_user_iter(). See commit 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()") for more details. Signed-off-by: Christophe Leroy --- lib/iov_iter.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index f9193f952f49..ebf524a37907 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -50,6 +50,13 @@ size_t copy_from_user_iter(void __user *iter_from, size_= t progress, if (should_fail_usercopy()) return len; if (access_ok(iter_from, len)) { + /* + * Ensure that bad access_ok() speculation will not + * lead to nasty side effects *after* the copy is + * finished: + */ + barrier_nospec(); + to +=3D progress; instrument_copy_from_user_before(to, iter_from, len); res =3D raw_copy_from_user(to, iter_from, len); --=20 2.49.0