linux-kernel - Re: [PATCH v2 4/4] x86/static_call: Add inline static call implementation for x86-64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181129124952.70b0385c@gandalf.local.home>
Date:   Thu, 29 Nov 2018 12:49:52 -0500
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Andy Lutomirski <luto@...capital.net>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        Andy Lutomirski <luto@...nel.org>, X86 ML <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Ingo Molnar <mingo@...nel.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Jason Baron <jbaron@...mai.com>, Jiri Kosina <jkosina@...e.cz>,
        David Laight <David.Laight@...lab.com>,
        Borislav Petkov <bp@...en8.de>, julia@...com, jeyu@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>
Subject: Re: [PATCH v2 4/4] x86/static_call: Add inline static call
 implementation for x86-64

On Thu, 29 Nov 2018 09:41:33 -0800
Andy Lutomirski <luto@...capital.net> wrote:

> > On Nov 29, 2018, at 9:21 AM, Steven Rostedt <rostedt@...dmis.org> wrote:
> > 
> > On Thu, 29 Nov 2018 12:20:00 -0500
> > Steven Rostedt <rostedt@...dmis.org> wrote:
> > 
> >   
> >> r8 = return address
> >> r9 = function to call
> >>   
> > 
> > Bad example, r8 and r9 are args, but r10 and r11 are available.
> > 
> > -- Steve
> >   
> >>    push r8
> >>    jmp *r9
> >> 
> >> Then have the regs->ip point to that trampoline.  
> 
> Cute. That’ll need ORC annotations and some kind of retpoline to replace the indirect jump, though.
>

Do we really need to worry about retpoline here?

I'm not fully up on all the current vulnerabilities, but can this
really be taken advantage of when it only happens in the transition of
changing a static call with the small chance of one of those calls
triggering the break point?

If someone can take advantage of that, I almost think they deserve
cracking my box ;-)

-- Steve