linux-kernel - Re: [PATCH 3/4] x86,module: Detect VMX vs SLD conflicts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200407104928.566db3f8@gandalf.local.home>
Date:   Tue, 7 Apr 2020 10:49:28 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Peter Zijlstra <peterz@...radead.org>, tglx@...utronix.de,
        linux-kernel@...r.kernel.org, hch@...radead.org,
        sean.j.christopherson@...el.com, mingo@...hat.com, bp@...en8.de,
        hpa@...or.com, x86@...nel.org, kenny@...ix.com, jeyu@...nel.org,
        rasmus.villemoes@...vas.dk, pbonzini@...hat.com,
        fenghua.yu@...el.com, xiaoyao.li@...el.com, nadav.amit@...il.com,
        thellstrom@...are.com, tony.luck@...el.com, jannh@...gle.com,
        keescook@...omium.org, David.Laight@...lab.com,
        dcovelli@...are.com, mhiramat@...nel.org
Subject: Re: [PATCH 3/4] x86,module: Detect VMX vs SLD conflicts

On Tue, 7 Apr 2020 16:35:43 +0200
Greg KH <gregkh@...uxfoundation.org> wrote:

> > Hypervisors, which have been modified and are known to work correctly,
> > can add:
> > 
> >   MODULE_INFO(sld_safe, "Y");
> > 
> > to explicitly tell the module loader they're good.  
> 
> What's to keep any out-of-tree module from adding this same module info
> "flag" and just lie about it?  Isn't that what you are trying to catch
> here, or is it a case of, "if you lie, your code will break" as well?

Keeping with the analogy to module kabi breakage, that would basically be
the same as an out of tree module fixing the api but not using it properly.
It will break.

All this is doing is to make sure VM modules that haven't been updated to
handle split lock detection, wont be loaded if split lock detection is
enabled. Saying you can handle SLD and not handling it is just broken code
and we can't really protect against that.

-- Steve