netdev - Re: [RFC PATCH 0/2] Branch Target Injection (BTI) gadget in minstrel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20221026001757.gyjzcwe5wznu6drj@desk>
Date:   Tue, 25 Oct 2022 17:17:57 -0700
From:   Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>
To:     Johannes Berg <johannes@...solutions.net>
Cc:     Peter Zijlstra <peterz@...radead.org>, scott.d.constable@...el.com,
        daniel.sneddon@...ux.intel.com, Jakub Kicinski <kuba@...nel.org>,
        dave.hansen@...el.com, Paolo Abeni <pabeni@...hat.com>,
        antonio.gomez.iglesias@...ux.intel.com,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
        x86@...nel.org, gregkh@...uxfoundation.org, netdev@...r.kernel.org
Subject: Re: [RFC PATCH 0/2] Branch Target Injection (BTI) gadget in minstrel

On Tue, Oct 25, 2022 at 09:56:21PM +0200, Johannes Berg wrote:
>On Tue, 2022-10-25 at 12:38 -0700, Pawan Gupta wrote:
>>
>> > And how is sprinking random LFENCEs around better than running with
>> > spectre_v2=eibrs,retpoline which is the current recommended mitigation
>> > against all this IIRC (or even eibrs,lfence for lesser values of
>> > paranoia).
>>
>> Its a trade-off between performance and spot fixing (hopefully handful
>> of) gadgets. Even the gadget in question here is not demonstrated to be
>> exploitable. If this scenario changes, polluting the kernel all over is
>> definitely not the right approach.
>>
>Btw, now I'm wondering - you were detecting these with the compiler
>based something, could there be a compiler pass to insert appropriate
>things, perhaps as a gcc plugin or something?

I hear it could be a lot of work for gcc. I am not sure if its worth
especially when we can't establish the exploitability of these gadgets.
There are some other challenges like, hot-path sites would prefer to
mask the indexes instead of using a speculation barrier for performance
reasons. I assume adding this intelligence to compilers would be
extremely hard. Also hardware controls and features in newer processors
will make the software mitigations redundant.