spectre: warn about potential spectre vulnerabilities

spectre: warn about potential spectre vulnerabilities

I'm not the world's leading expert in spectre (understatement), my
understanding is that the issue is that the user supplied an invalid array
offset and the computer reads from it speculatively, and only later does
the check to say "Oh, this is an invalid offset, let's return -EINVAL;"
But the problem is that traces of the read remain so we can use it to
figure out what was in the invalid offset.

The problem is that how vulnerable you are to Spectre depends on the CPU.
Some CPUs speculatively execute up to 200 instructions in advance.  Smatch
has no concept of instructions.

The kernel has an array_index_nospec() macro to turn off speculation for
a specific variable.

So what this check does is warn about where we're reading from an array and
the offset is controlled by the user, and we haven't used the
array_index_nospec() macro.  There is a sort of lazy attempt to say, "If
we've recently compared this offset to something, well that something was
probably the array limit so it's probably under the 200 instruction
barrier".

I get hundreds of warnings, on yesterday's linux-next:

488 warn: potential spectre issue ''
258 warn: potential spectre issue '' (local cap)

There are about 7 places which use the array_index_nospec() macro.
Logically, you would have expected those numbers to be closer together so
it probably indicates this test is very flawed.

Anyway, this is a first draft...

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>