linux-kernel - Re: [PATCH 06/18] x86, barrier: stop speculation for failed access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180106.203654.731754766847198456.davem@davemloft.net>
Date:   Sat, 06 Jan 2018 20:36:54 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     w@....eu
Cc:     gnomes@...rguk.ukuu.org.uk, alexei.starovoitov@...il.com,
        torvalds@...ux-foundation.org, dan.j.williams@...el.com,
        linux-kernel@...r.kernel.org, linux-arch@...r.kernel.org,
        ak@...ux.intel.com, arnd@...db.de, gregkh@...uxfoundation.org,
        peterz@...radead.org, netdev@...r.kernel.org, mingo@...hat.com,
        hpa@...or.com, tglx@...utronix.de
Subject: Re: [PATCH 06/18] x86, barrier: stop speculation for failed
 access_ok

From: Willy Tarreau <w@....eu>
Date: Sat, 6 Jan 2018 21:42:29 +0100

> On Sat, Jan 06, 2018 at 06:38:59PM +0000, Alan Cox wrote:
>> Normally people who propose security fixes don't have to argue about the
>> fact they added 30 clocks to avoid your box being 0wned.
> 
> In fact it depends, because if a fix makes the system unusable for its
> initial purpose, this fix will simply not be deployed at all, which is
> the worst that can happen.

+1

I completely agree with Willy and Alexei.

And the scale isn't even accurate, we're talking about at least
hundreds upon hundreds of clocks, not 30, if we add an operation whose
side effect is to wait for all pending loads to complete.  So yeah
this is going to be heavily scrutinized.