linux-kernel - Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Jul 2022 07:31:15 +0200
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Peter Zijlstra <peterz@...radead.org>,
        Justin Forbes <jforbes@...oraproject.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Shuah Khan <shuah@...nel.org>, patches@...nelci.org,
        lkft-triage@...ts.linaro.org, Pavel Machek <pavel@...x.de>,
        Jon Hunter <jonathanh@...dia.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Sudip Mukherjee <sudipm.mukherjee@...il.com>,
        Slade Watkins <slade@...dewatkins.com>,
        John Harrison <John.C.Harrison@...el.com>,
        Tejas Upadhyay <tejas.upadhyay@...el.com>,
        Anusha Srivatsa <anusha.srivatsa@...el.com>,
        Jani Nikula <jani.nikula@...el.com>,
        Daniele Ceraolo Spurio <daniele.ceraolospurio@...el.com>
Subject: Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

On 21. 07. 22, 0:00, Peter Zijlstra wrote:
> On Wed, Jul 20, 2022 at 11:47:02PM +0200, Peter Zijlstra wrote:
>> On Wed, Jul 20, 2022 at 12:57:26PM -0500, Justin Forbes wrote:
>>> On Wed, Jul 20, 2022 at 10:28:33AM -0700, Linus Torvalds wrote:
>>>> [ Adding PeterZ and Jiri to the participants. ]
>>>>
>>>> Looks like 5.18.13 added that commit 9bb2ec608a20 ("objtool: Update
>>>> Retpoline validation") but I don't see 3131ef39fb03 ("x86/asm/32: Fix
>>>> ANNOTATE_UNRET_SAFE use on 32-bit") in that list.
>>>
>>> It should be noted that the build doesn't fail, it just warns.
>>> I am guessing the 32bit failure is what promoted someone to look at
>>> the logs to begin with and notice the warn initially. I just verified
>>> that it exists in our builds of 5.18.13-rc1, but not on mainline builds.
>>> I am gueesing it is because commit 9bb2ec608a20 ("objtool: Update Retpoline
>>> validation") should be followed up with at least commit f43b9876e857c
>>> ("x86/retbleed: Add fine grained Kconfig knobs")
>>
>> Still updateing the stable repro to see what the actual code looks like,
>> but that warning seems to suggest the -mfunction-return=thunk-extern
>> compiler argument went missing.
>>
>> For all the files objtool complains about, does the V=1 build output
>> show that option?
> 
> Ok, I'm now looking at stable-rc/linux-5.18.y which reports itself as:
> 
> VERSION = 5
> PATCHLEVEL = 18
> SUBLEVEL = 13
> EXTRAVERSION = -rc1
> 
> and I'm most terribly confused... it has the objtool patch to validate
> return thunks, *however*, I'm not seeing any actual retbleed mitigations
> *anywhere*.
> 
> How, what, why!?

They were all put aside until all this gets resolved. You can find them 
in the stable-queue tree:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git

in retbleed-5.18/.

regards,
-- 
js
suse labs