linux-kernel - Re: Smatch check for Spectre stuff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180420172108.GA29920@redhat.com>
Date:   Fri, 20 Apr 2018 19:21:09 +0200
From:   Oleg Nesterov <oleg@...hat.com>
To:     Thomas Gleixner <tglx@...utronix.de>
Cc:     Dan Carpenter <dan.carpenter@...cle.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        "Gustavo A. R. Silva" <gustavo@...eddedor.com>
Subject: Re: Smatch check for Spectre stuff

On 04/20, Thomas Gleixner wrote:
>
> > kernel/signal.c:3457 do_sigaction() warn: potential spectre issue 'p->sighand->action'
>
> This one is correctly detected

Not sure,

	k = &p->sighand->action[sig-1];

calculates the addr, although we do '*oact = *k' later. I dunno.

> > kernel/signal.c:65 sig_handler() warn: potential spectre issue 't->sighand->action'
>
> It's unclear from a quick look whether it's really possible to speculate
> all over the other things there, but we probably err out on the safe side

at least not in do_sigaction(). And in fact do_sigaction() doesn't need
sig_handler() at all, it could use act->sa.sa_handler instead.

Oleg.