linux-kernel - Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yth67Ubo7PatL0AR@worktop.programming.kicks-ass.net>
Date:   Thu, 21 Jul 2022 00:00:13 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Justin Forbes <jforbes@...oraproject.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Jiri Slaby <jslaby@...e.cz>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Shuah Khan <shuah@...nel.org>, patches@...nelci.org,
        lkft-triage@...ts.linaro.org, Pavel Machek <pavel@...x.de>,
        Jon Hunter <jonathanh@...dia.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Sudip Mukherjee <sudipm.mukherjee@...il.com>,
        Slade Watkins <slade@...dewatkins.com>,
        John Harrison <John.C.Harrison@...el.com>,
        Tejas Upadhyay <tejas.upadhyay@...el.com>,
        Anusha Srivatsa <anusha.srivatsa@...el.com>,
        Jani Nikula <jani.nikula@...el.com>,
        Daniele Ceraolo Spurio <daniele.ceraolospurio@...el.com>
Subject: Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

On Wed, Jul 20, 2022 at 11:47:02PM +0200, Peter Zijlstra wrote:
> On Wed, Jul 20, 2022 at 12:57:26PM -0500, Justin Forbes wrote:
> > On Wed, Jul 20, 2022 at 10:28:33AM -0700, Linus Torvalds wrote:
> > > [ Adding PeterZ and Jiri to the participants. ]
> > > 
> > > Looks like 5.18.13 added that commit 9bb2ec608a20 ("objtool: Update
> > > Retpoline validation") but I don't see 3131ef39fb03 ("x86/asm/32: Fix
> > > ANNOTATE_UNRET_SAFE use on 32-bit") in that list.
> > 
> > It should be noted that the build doesn't fail, it just warns.
> > I am guessing the 32bit failure is what promoted someone to look at
> > the logs to begin with and notice the warn initially. I just verified
> > that it exists in our builds of 5.18.13-rc1, but not on mainline builds.
> > I am gueesing it is because commit 9bb2ec608a20 ("objtool: Update Retpoline
> > validation") should be followed up with at least commit f43b9876e857c
> > ("x86/retbleed: Add fine grained Kconfig knobs")
> 
> Still updateing the stable repro to see what the actual code looks like,
> but that warning seems to suggest the -mfunction-return=thunk-extern
> compiler argument went missing.
> 
> For all the files objtool complains about, does the V=1 build output
> show that option?

Ok, I'm now looking at stable-rc/linux-5.18.y which reports itself as:

VERSION = 5
PATCHLEVEL = 18
SUBLEVEL = 13
EXTRAVERSION = -rc1

and I'm most terribly confused... it has the objtool patch to validate
return thunks, *however*, I'm not seeing any actual retbleed mitigations
*anywhere*.

How, what, why!?