.. | .. |
---|
3 | 3 | #include <linux/fault-inject-usercopy.h> |
---|
4 | 4 | #include <linux/instrumented.h> |
---|
5 | 5 | #include <linux/uaccess.h> |
---|
| 6 | +#include <linux/nospec.h> |
---|
6 | 7 | |
---|
7 | 8 | /* out-of-line parts */ |
---|
8 | 9 | |
---|
.. | .. |
---|
12 | 13 | unsigned long res = n; |
---|
13 | 14 | might_fault(); |
---|
14 | 15 | if (!should_fail_usercopy() && likely(access_ok(from, n))) { |
---|
| 16 | + /* |
---|
| 17 | + * Ensure that bad access_ok() speculation will not |
---|
| 18 | + * lead to nasty side effects *after* the copy is |
---|
| 19 | + * finished: |
---|
| 20 | + */ |
---|
| 21 | + barrier_nospec(); |
---|
15 | 22 | instrument_copy_from_user(to, from, n); |
---|
16 | 23 | res = raw_copy_from_user(to, from, n); |
---|
17 | 24 | } |
---|