arm64: Use pointer masking to limit uaccess speculation
authorRobin Murphy <robin.murphy@arm.com>
Mon, 5 Feb 2018 15:34:19 +0000 (15:34 +0000)
committerCatalin Marinas <catalin.marinas@arm.com>
Tue, 6 Feb 2018 22:53:34 +0000 (22:53 +0000)
commit4d8efc2d5ee4c9ccfeb29ee8afd47a8660d0c0ce
tree74800afc7ba67d3e7ec3935b218d0c81c5459249
parent51369e398d0d33e8f524314e672b07e8cf870e79
arm64: Use pointer masking to limit uaccess speculation

Similarly to x86, mitigate speculation past an access_ok() check by
masking the pointer against the address limit before use.

Even if we don't expect speculative writes per se, it is plausible that
a CPU may still speculate at least as far as fetching a cache line for
writing, hence we also harden put_user() and clear_user() for peace of
mind.

Signed-off-by: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
arch/arm64/include/asm/uaccess.h