Re: [PATCH v2] x86/tls: Fix possible spectre-v1 in do_get_thread_area()

2019-06-25 Thread Dianzhang Chen
On Wed, Jun 26, 2019 at 12:38 AM Thomas Gleixner wrote: > > On Wed, 26 Jun 2019, Dianzhang Chen wrote: > > > The index to access the threads tls array is controlled by userspace > > via syscall: sys_ptrace(), hence leading to a potential exploitation > > of the Spectre variant 1 vulnerability. > >

Re: [PATCH v2] x86/tls: Fix possible spectre-v1 in do_get_thread_area()

2019-06-25 Thread Thomas Gleixner
On Wed, 26 Jun 2019, Dianzhang Chen wrote: > The index to access the threads tls array is controlled by userspace > via syscall: sys_ptrace(), hence leading to a potential exploitation > of the Spectre variant 1 vulnerability. > The idx can be controlled from: > ptrace -> arch_ptrace -> do

[PATCH v2] x86/tls: Fix possible spectre-v1 in do_get_thread_area()

2019-06-25 Thread Dianzhang Chen
The index to access the threads tls array is controlled by userspace via syscall: sys_ptrace(), hence leading to a potential exploitation of the Spectre variant 1 vulnerability. The idx can be controlled from: ptrace -> arch_ptrace -> do_get_thread_area. Fix this by sanitizing idx before u