Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

2018-07-31 Thread Josh Poimboeuf
On Tue, Jul 31, 2018 at 12:39:41AM -0600, Andreas Dilger wrote: > > Also it looks like XQM_MAXQUOTAS, MAXQUOTAS, and EXT4_MAXQUOTAS all > > have the same value (3). Maybe they can be consolidated to just use > > MAXQUOTAS everywhere? > > No, the filesystem-specific MAXQUOTAS values were separated

Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

2018-07-30 Thread Andreas Dilger
> On Jul 27, 2018, at 11:46 AM, Josh Poimboeuf wrote: > > On Fri, Jul 27, 2018 at 04:23:55PM +, Jeremy Cline wrote: >> 'type' is a user-controlled value used to index into 's_qf_names', which >> can be used in a Spectre v1 attack. Clamp 'type' to the size of the >> array to avoid a speculati

Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

2018-07-27 Thread Jeremy Cline
On 07/27/2018 01:46 PM, Josh Poimboeuf wrote: > On Fri, Jul 27, 2018 at 04:23:55PM +, Jeremy Cline wrote: >> 'type' is a user-controlled value used to index into 's_qf_names', which >> can be used in a Spectre v1 attack. Clamp 'type' to the size of the >> array to avoid a speculative out-of-bou

Re: [PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

2018-07-27 Thread Josh Poimboeuf
On Fri, Jul 27, 2018 at 04:23:55PM +, Jeremy Cline wrote: > 'type' is a user-controlled value used to index into 's_qf_names', which > can be used in a Spectre v1 attack. Clamp 'type' to the size of the > array to avoid a speculative out-of-bounds read. > > Cc: Josh Poimboeuf > Cc: sta...@vge

[PATCH 1/3] ext4: super: Fix spectre gadget in ext4_quota_on

2018-07-27 Thread Jeremy Cline
'type' is a user-controlled value used to index into 's_qf_names', which can be used in a Spectre v1 attack. Clamp 'type' to the size of the array to avoid a speculative out-of-bounds read. Cc: Josh Poimboeuf Cc: sta...@vger.kernel.org Signed-off-by: Jeremy Cline --- fs/ext4/super.c | 2 ++ 1 f