linux-kernel - Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 Jul 2022 08:07:51 +0200
From:   Jiri Slaby <jirislaby@...nel.org>
To:     Peter Zijlstra <peterz@...radead.org>,
        Justin Forbes <jforbes@...oraproject.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        stable <stable@...r.kernel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Guenter Roeck <linux@...ck-us.net>,
        Shuah Khan <shuah@...nel.org>, patches@...nelci.org,
        lkft-triage@...ts.linaro.org, Pavel Machek <pavel@...x.de>,
        Jon Hunter <jonathanh@...dia.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Sudip Mukherjee <sudipm.mukherjee@...il.com>,
        Slade Watkins <slade@...dewatkins.com>,
        John Harrison <John.C.Harrison@...el.com>,
        Tejas Upadhyay <tejas.upadhyay@...el.com>,
        Anusha Srivatsa <anusha.srivatsa@...el.com>,
        Jani Nikula <jani.nikula@...el.com>,
        Daniele Ceraolo Spurio <daniele.ceraolospurio@...el.com>
Subject: Re: [PATCH 5.18 000/231] 5.18.13-rc1 review

On 21. 07. 22, 7:31, Jiri Slaby wrote:
> On 21. 07. 22, 0:00, Peter Zijlstra wrote:
>> On Wed, Jul 20, 2022 at 11:47:02PM +0200, Peter Zijlstra wrote:
>>> On Wed, Jul 20, 2022 at 12:57:26PM -0500, Justin Forbes wrote:
>>>> On Wed, Jul 20, 2022 at 10:28:33AM -0700, Linus Torvalds wrote:
>>>>> [ Adding PeterZ and Jiri to the participants. ]
>>>>>
>>>>> Looks like 5.18.13 added that commit 9bb2ec608a20 ("objtool: Update
>>>>> Retpoline validation") but I don't see 3131ef39fb03 ("x86/asm/32: Fix
>>>>> ANNOTATE_UNRET_SAFE use on 32-bit") in that list.
>>>>
>>>> It should be noted that the build doesn't fail, it just warns.
>>>> I am guessing the 32bit failure is what promoted someone to look at
>>>> the logs to begin with and notice the warn initially. I just verified
>>>> that it exists in our builds of 5.18.13-rc1, but not on mainline 
>>>> builds.
>>>> I am gueesing it is because commit 9bb2ec608a20 ("objtool: Update 
>>>> Retpoline
>>>> validation") should be followed up with at least commit f43b9876e857c
>>>> ("x86/retbleed: Add fine grained Kconfig knobs")
>>>
>>> Still updateing the stable repro to see what the actual code looks like,
>>> but that warning seems to suggest the -mfunction-return=thunk-extern
>>> compiler argument went missing.
>>>
>>> For all the files objtool complains about, does the V=1 build output
>>> show that option?
>>
>> Ok, I'm now looking at stable-rc/linux-5.18.y which reports itself as:
>>
>> VERSION = 5
>> PATCHLEVEL = 18
>> SUBLEVEL = 13
>> EXTRAVERSION = -rc1
>>
>> and I'm most terribly confused... it has the objtool patch to validate
>> return thunks, *however*, I'm not seeing any actual retbleed mitigations
>> *anywhere*.
>>
>> How, what, why!?
> 
> They were all put aside until all this gets resolved. You can find them 
> in the stable-queue tree:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git
> 
> in retbleed-5.18/.

Ah, apparently not all, as you noted above. But this is obviously a mistake:
https://lore.kernel.org/all/YthbbBY4JumsBcHU@kroah.com/

> regards,-- 
-- 
js
suse labs