linux-kernel - Re: [PATCH v2 5/8] x86/speculation: Add basic support for IBPB

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f9141600-45e4-999a-e997-05eeb56cda29@citrix.com>
Date:   Sun, 21 Jan 2018 19:37:14 +0000
From:   Andrew Cooper <andrew.cooper3@...rix.com>
To:     David Woodhouse <dwmw2@...radead.org>,
        Borislav Petkov <bp@...en8.de>,
        KarimAllah Ahmed <karahmed@...zon.com>
CC:     <arjan@...ux.intel.com>, <tglx@...utronix.de>,
        <karahmed@...zon.de>, <x86@...nel.org>,
        <linux-kernel@...r.kernel.org>, <tim.c.chen@...ux.intel.com>,
        <peterz@...radead.org>, <pbonzini@...hat.com>,
        <ak@...ux.intel.com>, <torvalds@...ux-foundation.org>,
        <gregkh@...ux-foundation.org>
Subject: Re: [PATCH v2 5/8] x86/speculation: Add basic support for IBPB

On 21/01/18 19:31, David Woodhouse wrote:
> On Sun, 2018-01-21 at 20:01 +0100, Borislav Petkov wrote:
>> so execution runs directly into the MSR write and the JMP is gone.
>>
>> So I don't see indirect branches anywhere...
> Wait until the wind changes.
>
> Congratulations, you've just turned a potential GCC missed optimisation
> into a kernel bug. We don't *care* that it's unlikely that GCC will
> miss that optimisation. The point is that it doesn't *have* to do it,
> and we don't *check*.
>
> cf. https://lkml.org/lkml/2018/1/12/176
>
>
> ... after which Peter went off and implemented that check, which is all
> fine and dandy but let's not rely on backporting that too.

It doesn't matter if an attacker can use SP1 to try and skip the IBPB.

Exits to userspace/guest are serialising (with some retroactive updates
to the architecture spec coming), so an attacker can't cause victim code
to be executed before speculation has caught up and noticed that the
IBPB did need to happen.

~Andrew