| .. | .. |
|---|
| 3 | 3 | #include <linux/fault-inject-usercopy.h> |
|---|
| 4 | 4 | #include <linux/instrumented.h> |
|---|
| 5 | 5 | #include <linux/uaccess.h> |
|---|
| 6 | +#include <linux/nospec.h> |
|---|
| 6 | 7 | |
|---|
| 7 | 8 | /* out-of-line parts */ |
|---|
| 8 | 9 | |
|---|
| .. | .. |
|---|
| 12 | 13 | unsigned long res = n; |
|---|
| 13 | 14 | might_fault(); |
|---|
| 14 | 15 | if (!should_fail_usercopy() && likely(access_ok(from, n))) { |
|---|
| 16 | + /* |
|---|
| 17 | + * Ensure that bad access_ok() speculation will not |
|---|
| 18 | + * lead to nasty side effects *after* the copy is |
|---|
| 19 | + * finished: |
|---|
| 20 | + */ |
|---|
| 21 | + barrier_nospec(); |
|---|
| 15 | 22 | instrument_copy_from_user(to, from, n); |
|---|
| 16 | 23 | res = raw_copy_from_user(to, from, n); |
|---|
| 17 | 24 | } |
|---|