linux-kernel - Re: Smatch check for Spectre stuff

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 23 Apr 2018 06:48:17 -0700
From:   Dan Williams <dan.j.williams@...el.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: Smatch check for Spectre stuff

On Mon, Apr 23, 2018 at 5:45 AM, Peter Zijlstra <peterz@...radead.org> wrote:
> On Mon, Apr 23, 2018 at 07:31:03AM -0500, Gustavo A. R. Silva wrote:
>> Hi Peter,
>>
>> On 04/20/2018 07:00 AM, Peter Zijlstra wrote:
>> >
>> > Hi Dan,
>> >
>> > awesome stuff...
>> >
>> > So I fear that many are actually things we want to fix. Our policy was
>> > to kill the speculation on the first load and not worry if it can be
>> > completed with a dependent load/store.
>> >
>> I wonder if there is any thread where I can read the discussion about that
>> policy that you mention.
>>
>> Could you share it here, please?
>
> I think it was somewhere in the many spectre variant1 threads when Linus
> Alexei and Dan W were hashing out the mitigation thing. I cannot quickly
> find the specific email.
>
> Clarifying that position was one reason for the patches I did, Linus and
> Dan W are on Cc and I figure that if they all agree we should maybe add
> a little something to Documentation/speculation.txt.

Yes, given that speculation windows are large if an attacker can
trigger one out of bounds read it is difficult to identify that all of
possible speculation from that point is safe, or that future code
changes will not introduce a data ex-filtration sequence relative to
that first out of bounds access. This is also the reason we protect
all get_user() and __get_user() instances.