Re: [PATCH] retpoline/module: Taint kernel for missing retpoline in module

[David Woodhouse <dwmw2@infradead.org>]

[-- Attachment #1: Type: text/plain, Size: 1594 bytes --]

On Fri, 2018-01-12 at 09:55 -0800, Andi Kleen wrote:
> From: Andi Kleen <ak@linux.intel.com>
> 
> There's a risk that a kernel that has full retpoline mitigations
> becomes vulnerable when a module gets loaded that hasn't been
> compiled with the right compiler or the right option.
> 
> We cannot fix it, but should at least warn the user when that
> happens.
> 
> Add a flag to each module if it has been compiled with RETPOLINE
> 
> When the a module hasn't been compiled with a retpoline
> aware compiler, print a warning and set a taint flag.
> 
> For modules it is checked at compile time, however it cannot
> check assembler or other non compiled objects used in the module link.
> 
> Due to lack of better letter it uses taint option 'Z'
> 
> We only set the taint flag for incorrectly compiled modules
> now, not for the main kernel, which already has other
> report mechanisms.
> 
> Also make sure to report vulnerable for spectre if such a module
> has been loaded.

Thanks for reviving this; it got dropped partly because it has
conflicts between the tip/x86/pti tree and Linus' 4.15-rc.

The other reason for dropping it was because I think we probably want
to revisit this whole thing once we have all the mitigations in place.

It doesn't make a lot of sense to have a taint flag for a *partial*
retpoline, but not in the case that we have *no* mitigation in place.

So maybe we should drop the taint part, and just make the kernel report
that it is (partially) vulnerable to Spectre V2, just as in the
CONFIG_RETPOLINE && !RETPOLINE case?

[-- Attachment #2: smime.p7s --]
[-- Type: application/x-pkcs7-signature, Size: 5213 bytes --]