linux-kernel - Re: [PATCH 5.18 34/61] objtool: Update Retpoline validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <509dd891-73cc-31b9-18ac-2e930084c02f@kernel.org>
Date:   Wed, 13 Jul 2022 09:54:01 +0200
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-kernel@...r.kernel.org
Cc:     stable@...r.kernel.org,
        "Peter Zijlstra (Intel)" <peterz@...radead.org>,
        Borislav Petkov <bp@...e.de>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        Thadeu Lima de Souza Cascardo <cascardo@...onical.com>
Subject: Re: [PATCH 5.18 34/61] objtool: Update Retpoline validation

On 13. 07. 22, 9:45, Jiri Slaby wrote:
> On 12. 07. 22, 20:39, Greg Kroah-Hartman wrote:
>> From: Peter Zijlstra <peterz@...radead.org>
>>
>> commit 9bb2ec608a209018080ca262f771e6a9ff203b6f upstream.
>>
>> Update retpoline validation with the new CONFIG_RETPOLINE requirement of
>> not having bare naked RET instructions.
> 
> Hi,
> 
> this breaks compilation on i386:
>  > arch/x86/kernel/../../x86/xen/xen-head.S:35: Error: no such 
> instruction: `annotate_unret_safe'
> 
> Config:
> https://raw.githubusercontent.com/openSUSE/kernel-source/stable/config/i386/pae 
> 
> 
> And yeah, upstream¹⁾ is affected too.
> 
> ¹⁾I am at commit b047602d579b4fb028128a525f056bbdc890e7f0.

A naive fix is:
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -23,6 +23,7 @@
  #include <asm/cpufeatures.h>
  #include <asm/percpu.h>
  #include <asm/nops.h>
+#include <asm/nospec-branch.h>
  #include <asm/bootparam.h>
  #include <asm/export.h>
  #include <asm/pgtable_32.h>

The question (I don't know answer to) is whether x86_32 should actually 
do ANNOTATE_UNRET_SAFE.

thanks,
-- 
js