linux-kernel - Re: [PATCH 4.9 29/39] x86/kaiser: Check boottime cmdline params

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1515024968.2714.171.camel@decadent.org.uk>
Date:   Thu, 04 Jan 2018 00:16:08 +0000
From:   Ben Hutchings <ben@...adent.org.uk>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
Cc:     stable@...r.kernel.org, Borislav Petkov <bp@...e.de>
Subject: Re: [PATCH 4.9 29/39] x86/kaiser: Check boottime cmdline params

On Wed, 2018-01-03 at 21:11 +0100, Greg Kroah-Hartman wrote:
> 4.9-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Borislav Petkov <bp@...e.de>
> 
> 
> AMD (and possibly other vendors) are not affected by the leak
> KAISER is protecting against.
[...]
> +void __init kaiser_check_boottime_disable(void)
> +{
> +	bool enable = true;
> +	char arg[5];
> +	int ret;
> +
> +	ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg));
> +	if (ret > 0) {
> +		if (!strncmp(arg, "on", 2))
> +			goto enable;
> +
> +		if (!strncmp(arg, "off", 3))
> +			goto disable;
> +
> +		if (!strncmp(arg, "auto", 4))
> +			goto skip;
> +	}
> +
> +	if (cmdline_find_option_bool(boot_command_line, "nopti"))
> +		goto disable;
> +
> +skip:
> +	if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
> +		goto disable;
[...]

No such exception has been added upstream, so I don't think it's
appropriate to add it in stable.

Ben.

-- 
Ben Hutchings
Quantity is no substitute for quality, but it's the only one we've got.


Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)