[lkml]   [2018]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
SubjectRe: [PATCH] retpoline/module: Taint kernel for missing retpoline in module
On Fri, 2018-01-12 at 09:55 -0800, Andi Kleen wrote:
> From: Andi Kleen <>
> There's a risk that a kernel that has full retpoline mitigations
> becomes vulnerable when a module gets loaded that hasn't been
> compiled with the right compiler or the right option.
> We cannot fix it, but should at least warn the user when that
> happens.
> Add a flag to each module if it has been compiled with RETPOLINE
> When the a module hasn't been compiled with a retpoline
> aware compiler, print a warning and set a taint flag.
> For modules it is checked at compile time, however it cannot
> check assembler or other non compiled objects used in the module link.
> Due to lack of better letter it uses taint option 'Z'
> We only set the taint flag for incorrectly compiled modules
> now, not for the main kernel, which already has other
> report mechanisms.
> Also make sure to report vulnerable for spectre if such a module
> has been loaded.

Thanks for reviving this; it got dropped partly because it has
conflicts between the tip/x86/pti tree and Linus' 4.15-rc.

The other reason for dropping it was because I think we probably want
to revisit this whole thing once we have all the mitigations in place.

It doesn't make a lot of sense to have a taint flag for a *partial*
retpoline, but not in the case that we have *no* mitigation in place.

So maybe we should drop the taint part, and just make the kernel report
that it is (partially) vulnerable to Spectre V2, just as in the
[unhandled content-type:application/x-pkcs7-signature]
 \ /
  Last update: 2018-01-14 23:26    [W:0.410 / U:0.416 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site