powerpc: Add barrier_nospec to raw_copy_in_user()
authorSuraj Jitindar Singh <sjitindarsingh@gmail.com>
Wed, 6 Mar 2019 01:10:38 +0000 (12:10 +1100)
committerMichael Ellerman <mpe@ellerman.id.au>
Wed, 3 Jul 2019 05:19:36 +0000 (15:19 +1000)
Commit ddf35cf3764b ("powerpc: Use barrier_nospec in copy_from_user()")
Added barrier_nospec before loading from user-controlled pointers. The
intention was to order the load from the potentially user-controlled
pointer vs a previous branch based on an access_ok() check or similar.

In order to achieve the same result, add a barrier_nospec to the
raw_copy_in_user() function before loading from such a user-controlled
pointer.

Fixes: ddf35cf3764b ("powerpc: Use barrier_nospec in copy_from_user()")
Signed-off-by: Suraj Jitindar Singh <sjitindarsingh@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
arch/powerpc/include/asm/uaccess.h

index 76f34346b642d1b4f9aa8ac7e1c3a04f7c7b8646..8b03eb44e876eef7395880eed7eefcef694990d7 100644 (file)
@@ -312,6 +312,7 @@ raw_copy_in_user(void __user *to, const void __user *from, unsigned long n)
 {
        unsigned long ret;
 
+       barrier_nospec();
        allow_user_access(to, from, n);
        ret = __copy_tofrom_user(to, from, n);
        prevent_user_access(to, from, n);