linux-kernel - [PATCH 0/3] Ensure default return thunk isn't used at runtime

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231010171020.462211-1-david.kaplan@amd.com>
Date:   Tue, 10 Oct 2023 12:10:17 -0500
From:   David Kaplan <david.kaplan@....com>
To:     <x86@...nel.org>, <luto@...nel.org>
CC:     <linux-kernel@...r.kernel.org>
Subject: [PATCH 0/3] Ensure default return thunk isn't used at runtime

Several CPU side-channel mitigations require the use of a special return thunk.
The necessary return thunk is installed at runtime via apply_returns(), after
which point the default return thunk (__x86_return_thunk) should never be used.

Patch 3 enforces this by modifying __x86_return_thunk to be a ud2 after
alternatives are applied.  

Patch 1 reverts a recent commit which resulted in retpoline sequences not being
annotated as containing returns, which was leaving them using the default return
thunk.

Patch 2 fixes an issue where functions in vdso32-setup were using the default
return thunk because objtool was not being run on them in some cases.

David Kaplan (3):
  Revert "x86/retpoline: Remove .text..__x86.return_thunk section"
  x86/vdso: Run objtool on vdso32-setup
  x86/retpoline: Ensure default return thunk isn't used at runtime

 arch/x86/entry/vdso/Makefile  |  3 ++-
 arch/x86/kernel/vmlinux.lds.S |  3 +++
 arch/x86/lib/retpoline.S      | 10 +++++++---
 3 files changed, 12 insertions(+), 4 deletions(-)

-- 
2.25.1