Commit 74e19ef0ff80 ("uaccess: Add speculation barrier to
copy_from_user()") added a redundant barrier_nospec() in
copy_from_user(), because powerpc is already calling
barrier_nospec() in allow_read_from_user() and
allow_read_write_user(). But on other architectures that
call to barrier_nospec() was missing. So change powerpc
instead of reverting the above commit and having to fix
other architectures one by one. This is now possible
because barrier_nospec() has also been added in
copy_from_user_iter().

Move barrier_nospec() out of allow_read_from_user() and
allow_read_write_user(). This will also allow reuse of those
functions when implementing masked user access which doesn't
require barrier_nospec().

Don't add it back in raw_copy_from_user() as it is already called
by copy_from_user() and copy_from_user_iter().

Fixes: 74e19ef0ff80 ("uaccess: Add speculation barrier to copy_from_user()")
Signed-off-by: Christophe Leroy <christophe.le...@csgroup.eu>
---
 arch/powerpc/include/asm/kup.h     | 2 --
 arch/powerpc/include/asm/uaccess.h | 4 ++++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/include/asm/kup.h b/arch/powerpc/include/asm/kup.h
index 2bb03d941e3e..6737416dde9f 100644
--- a/arch/powerpc/include/asm/kup.h
+++ b/arch/powerpc/include/asm/kup.h
@@ -134,7 +134,6 @@ static __always_inline void kuap_assert_locked(void)
 
 static __always_inline void allow_read_from_user(const void __user *from, 
unsigned long size)
 {
-       barrier_nospec();
        allow_user_access(NULL, from, size, KUAP_READ);
 }
 
@@ -146,7 +145,6 @@ static __always_inline void allow_write_to_user(void __user 
*to, unsigned long s
 static __always_inline void allow_read_write_user(void __user *to, const void 
__user *from,
                                                  unsigned long size)
 {
-       barrier_nospec();
        allow_user_access(to, from, size, KUAP_READ_WRITE);
 }
 
diff --git a/arch/powerpc/include/asm/uaccess.h 
b/arch/powerpc/include/asm/uaccess.h
index 4f5a46a77fa2..3987a5c33558 100644
--- a/arch/powerpc/include/asm/uaccess.h
+++ b/arch/powerpc/include/asm/uaccess.h
@@ -301,6 +301,7 @@ do {                                                        
        \
        __typeof__(sizeof(*(ptr))) __gu_size = sizeof(*(ptr));  \
                                                                \
        might_fault();                                  \
+       barrier_nospec();                                       \
        allow_read_from_user(__gu_addr, __gu_size);             \
        __get_user_size_allowed(__gu_val, __gu_addr, __gu_size, __gu_err);      
\
        prevent_read_from_user(__gu_addr, __gu_size);           \
@@ -329,6 +330,7 @@ raw_copy_in_user(void __user *to, const void __user *from, 
unsigned long n)
 {
        unsigned long ret;
 
+       barrier_nospec();
        allow_read_write_user(to, from, n);
        ret = __copy_tofrom_user(to, from, n);
        prevent_read_write_user(to, from, n);
@@ -415,6 +417,7 @@ static __must_check __always_inline bool 
user_access_begin(const void __user *pt
 
        might_fault();
 
+       barrier_nospec();
        allow_read_write_user((void __user *)ptr, ptr, len);
        return true;
 }
@@ -431,6 +434,7 @@ user_read_access_begin(const void __user *ptr, size_t len)
 
        might_fault();
 
+       barrier_nospec();
        allow_read_from_user(ptr, len);
        return true;
 }
-- 
2.49.0


Reply via email to