On Sat, 2025-07-05 at 21:09 +0200, Luis Gerhorst wrote:
> We must terminate the speculative analysis if the just-analyzed insn had
> nospec_result set. Using cur_aux() here is wrong because insn_idx might
> have been incremented by do_check_insn(). Therefore, introduce and use
> insn_aux variable.
>
> Also change cur_aux(env)->nospec in case do_check_insn() ever manages to
> increment insn_idx but still fail.
>
> Change the warning to check the insn class (which prevents it from
> triggering for ldimm64, for which nospec_result would not be
> problematic) and use verifier_bug_if().
>
> In line with Eduard's suggestion, do not introduce prev_aux() because
> that requires one to understand that after do_check_insn() call what was
> current became previous. This would at-least require a comment.
>
> Fixes: d6f1c85f2253 ("bpf: Fall back to nospec for Spectre v1")
> Reported-by: Paul Chaignon <[email protected]>
> Reported-by: Eduard Zingerman <[email protected]>
> Reported-by: [email protected]
> Link:
> https://lore.kernel.org/bpf/[email protected]/
> Link:
> https://lore.kernel.org/bpf/[email protected]/
> Suggested-by: Eduard Zingerman <[email protected]>
> Signed-off-by: Luis Gerhorst <[email protected]>
> ---
Acked-by: Eduard Zingerman <[email protected]>
[...]
