netdev - Re: [PATCH 00/18] prevent bounds-check bypass via speculative execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.00.1801092017330.27010@gjva.wvxbf.pm>
Date:   Tue, 9 Jan 2018 20:34:37 +0100 (CET)
From:   Jiri Kosina <jikos@...nel.org>
To:     Dan Williams <dan.j.williams@...el.com>
cc:     linux-kernel@...r.kernel.org, Mark Rutland <mark.rutland@....com>,
        peterz@...radead.org, Alan Cox <alan.cox@...el.com>,
        Srinivas Pandruvada <srinivas.pandruvada@...ux.intel.com>,
        Will Deacon <will.deacon@....com>,
        Solomon Peachy <pizza@...ftnet.org>,
        "H. Peter Anvin" <hpa@...or.com>,
        Christian Lamparter <chunkeey@...glemail.com>,
        Elena Reshetova <elena.reshetova@...el.com>,
        linux-arch@...r.kernel.org, Andi Kleen <ak@...ux.intel.com>,
        "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        linux-scsi@...r.kernel.org, Jonathan Corbet <corbet@....net>,
        x86@...nel.org, Ingo Molnar <mingo@...hat.com>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Zhang Rui <rui.zhang@...el.com>, linux-media@...r.kernel.org,
        Arnd Bergmann <arnd@...db.de>, Jan Kara <jack@...e.com>,
        Eduardo Valentin <edubezval@...il.com>,
        Al Viro <viro@...iv.linux.org.uk>, qla2xxx-upstream@...gic.com,
        Thomas Gleixner <tglx@...utronix.de>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Arjan van de Ven <arjan@...ux.intel.com>,
        Kalle Valo <kvalo@...eaurora.org>, alan@...ux.intel.com,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        gregkh@...uxfoundation.org, linux-wireless@...r.kernel.org,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        netdev@...r.kernel.org,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        "David S. Miller" <davem@...emloft.net>,
        Laurent Pinchart <laurent.pinchart@...asonboard.com>
Subject: Re: [PATCH 00/18] prevent bounds-check bypass via speculative
 execution

On Fri, 5 Jan 2018, Dan Williams wrote:

[ ... snip ... ]
> Andi Kleen (1):
>       x86, barrier: stop speculation for failed access_ok
> 
> Dan Williams (13):
>       x86: implement nospec_barrier()
>       [media] uvcvideo: prevent bounds-check bypass via speculative execution
>       carl9170: prevent bounds-check bypass via speculative execution
>       p54: prevent bounds-check bypass via speculative execution
>       qla2xxx: prevent bounds-check bypass via speculative execution
>       cw1200: prevent bounds-check bypass via speculative execution
>       Thermal/int340x: prevent bounds-check bypass via speculative execution
>       ipv6: prevent bounds-check bypass via speculative execution
>       ipv4: prevent bounds-check bypass via speculative execution
>       vfs, fdtable: prevent bounds-check bypass via speculative execution
>       net: mpls: prevent bounds-check bypass via speculative execution
>       udf: prevent bounds-check bypass via speculative execution
>       userns: prevent bounds-check bypass via speculative execution
> 
> Mark Rutland (4):
>       asm-generic/barrier: add generic nospec helpers
>       Documentation: document nospec helpers
>       arm64: implement nospec_ptr()
>       arm: implement nospec_ptr()

So considering the recent publication of [1], how come we all of a sudden 
don't need the barriers in ___bpf_prog_run(), namely for LD_IMM_DW and 
LDX_MEM_##SIZEOP, and something comparable for eBPF JIT?

Is this going to be handled in eBPF in some other way?

Without that in place, and considering Jann Horn's paper, it would seem 
like PTI doesn't really lock it down fully, right?

[1] https://bugs.chromium.org/p/project-zero/issues/attachmentText?aid=287305

-- 
Jiri Kosina
SUSE Labs