From: Will Deacon <will.deacon@arm.com>

Date: Mon, 5 Feb 2018 15:34:20 +0000

Subject: arm64: entry: Ensure branch through syscall table is bounded under

 speculation

Git-commit: 6314d90e64936c584f300a52ef173603fb2461b5

Patch-mainline: v4.16-rc1

References: bsc#1068032

In a similar manner to array_index_mask_nospec, this patch introduces an

assembly macro (mask_nospec64) which can be used to bound a value under

speculation. This macro is then used to ensure that the indirect branch

through the syscall table is bounded under speculation, with out-of-range

addresses speculating as calls to sys_io_setup (0).

Reviewed-by: Mark Rutland <mark.rutland@arm.com>

Signed-off-by: Will Deacon <will.deacon@arm.com>

Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

[mb: use scno and sc_nr instead of xscno and xsc_nr]

Signed-off-by: Matthias Brugger <mbrugger@suse.com>

---

 arch/arm64/include/asm/assembler.h |   11 +++++++++++

 arch/arm64/kernel/entry.S          |    1 +

 2 files changed, 12 insertions(+)

--- a/arch/arm64/include/asm/assembler.h

+++ b/arch/arm64/include/asm/assembler.h

@@ -115,6 +115,17 @@

 	.endm

 /*

+ * Sanitise a 64-bit bounded index wrt speculation, returning zero if out

+ * of bounds.

+ */

+	.macro	mask_nospec64, idx, limit, tmp

+	sub	\tmp, \idx, \limit

+	bic	\tmp, \tmp, \idx

+	and	\idx, \idx, \tmp, asr #63

+	csdb

+	.endm

+

+/*

  * NOP sequence

  */

 	.macro	nops, num

--- a/arch/arm64/kernel/entry.S

+++ b/arch/arm64/kernel/entry.S

@@ -901,6 +901,7 @@ el0_svc_naked:					// compat entry point

 	b.ne	__sys_trace

 	cmp     scno, sc_nr                     // check upper syscall limit

 	b.hs	ni_sys

+	mask_nospec64 scno, sc_nr, x19	// enforce bounds for syscall number

 	ldr	x16, [stbl, scno, lsl #3]	// address in the syscall table

 	blr	x16				// call sys_* routine

 	b	ret_fast_syscall