arm64: entry: Ensure branch through syscall table is bounded under speculation

From: Will Deacon <will.deacon@arm.com>

commit 6314d90e64936c584f300a52ef173603fb2461b5 upstream.

In a similar manner to array_index_mask_nospec, this patch introduces an
assembly macro (mask_nospec64) which can be used to bound a value under
speculation. This macro is then used to ensure that the indirect branch
through the syscall table is bounded under speculation, with out-of-range
addresses speculating as calls to sys_io_setup (0).

Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[v4.9: use existing scno & sc_nr definitions]
Signed-off-by: Mark Rutland <mark.rutland@arm.com> [v4.9 backport]
Tested-by: Greg Hackmann <ghackmann@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
index b223b1b..540c24f 100644 (file)
--- a/arch/arm64/include/asm/assembler.h
+++ b/arch/arm64/include/asm/assembler.h
@@ -94,6 +94,17 @@
        .endm
 
 /*
+ * Sanitise a 64-bit bounded index wrt speculation, returning zero if out
+ * of bounds.
+ */
+       .macro  mask_nospec64, idx, limit, tmp
+       sub     \tmp, \idx, \limit
+       bic     \tmp, \tmp, \idx
+       and     \idx, \idx, \tmp, asr #63
+       csdb
+       .endm
+
+/*
  * NOP sequence
  */
        .macro  nops, num

diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 3f1cd7a..c154b16 100644 (file)
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -795,6 +795,7 @@ el0_svc_naked:                                      // compat entry point
        b.ne    __sys_trace
        cmp     scno, sc_nr                     // check upper syscall limit
        b.hs    ni_sys
+       mask_nospec64 scno, sc_nr, x19  // enforce bounds for syscall number
        ldr     x16, [stbl, scno, lsl #3]       // address in the syscall table
        blr     x16                             // call sys_* routine
        b       ret_fast_syscall