Michael Ellerman writes:
> Nathan Lynch writes:
>>
>> 1. The patch sanitizes 'nargs' immediately before the call to memset(),
>>but shouldn't that happen before 'nargs' is used as an input to
>>copy_from_user()?
>
> I think the reasoning is that there's no way to exploit an out of bounds
Nathan Lynch writes:
> Michael Ellerman writes:
>> Breno Leitao writes:
>>> On Tue, Mar 12, 2024 at 08:17:42AM +, Christophe Leroy wrote:
+Nathan as this is RTAS related.
>
> Thanks!
>
Le 21/08/2018 à 20:42, Breno Leitao a écrit :
> The rtas syscall reads a value from a user-p
Michael Ellerman writes:
> Breno Leitao writes:
>> On Tue, Mar 12, 2024 at 08:17:42AM +, Christophe Leroy wrote:
>>> +Nathan as this is RTAS related.
Thanks!
>>> Le 21/08/2018 à 20:42, Breno Leitao a écrit :
>>> > The rtas syscall reads a value from a user-provided structure and uses it
>>
On Tue, Mar 12, 2024 at 10:07:54PM +1100, Michael Ellerman wrote:
> Breno Leitao writes:
> > On Tue, Mar 12, 2024 at 08:17:42AM +, Christophe Leroy wrote:
> >> +Nathan as this is RTAS related.
> >>
> >> Le 21/08/2018 à 20:42, Breno Leitao a écrit :
> >> > The rtas syscall reads a value from a
Breno Leitao writes:
> On Tue, Mar 12, 2024 at 08:17:42AM +, Christophe Leroy wrote:
>> +Nathan as this is RTAS related.
>>
>> Le 21/08/2018 à 20:42, Breno Leitao a écrit :
>> > The rtas syscall reads a value from a user-provided structure and uses it
>> > to index an array, being a possible
On Tue, Mar 12, 2024 at 08:17:42AM +, Christophe Leroy wrote:
> +Nathan as this is RTAS related.
>
> Le 21/08/2018 à 20:42, Breno Leitao a écrit :
> > The rtas syscall reads a value from a user-provided structure and uses it
> > to index an array, being a possible area for a potential spectre
+Nathan as this is RTAS related.
Le 21/08/2018 à 20:42, Breno Leitao a écrit :
> The rtas syscall reads a value from a user-provided structure and uses it
> to index an array, being a possible area for a potential spectre v1 attack.
> This is the code that exposes this problem.
>
> args.ret
The rtas syscall reads a value from a user-provided structure and uses it
to index an array, being a possible area for a potential spectre v1 attack.
This is the code that exposes this problem.
args.rets = &args.args[nargs];
The nargs is an user provided value, and the below code is an ex
