lkml.org 
[lkml]   [2018]   [Mar]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 46/76] module/retpoline: Warn about missing retpoline in module
    3.16.56-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andi Kleen <ak@linux.intel.com>

    commit caf7501a1b4ec964190f31f9c3f163de252273b8 upstream.

    There's a risk that a kernel which has full retpoline mitigations becomes
    vulnerable when a module gets loaded that hasn't been compiled with the
    right compiler or the right option.

    To enable detection of that mismatch at module load time, add a module info
    string "retpoline" at build time when the module was compiled with
    retpoline support. This only covers compiled C source, but assembler source
    or prebuilt object files are not checked.

    If a retpoline enabled kernel detects a non retpoline protected module at
    load time, print a warning and report it in the sysfs vulnerability file.

    [ tglx: Massaged changelog ]

    Signed-off-by: Andi Kleen <ak@linux.intel.com>
    Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
    Cc: David Woodhouse <dwmw2@infradead.org>
    Cc: gregkh@linuxfoundation.org
    Cc: torvalds@linux-foundation.org
    Cc: jeyu@kernel.org
    Cc: arjan@linux.intel.com
    Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    arch/x86/kernel/cpu/bugs.c | 17 ++++++++++++++++-
    include/linux/module.h | 9 +++++++++
    kernel/module.c | 11 +++++++++++
    scripts/mod/modpost.c | 9 +++++++++
    4 files changed, 45 insertions(+), 1 deletion(-)

    --- a/arch/x86/kernel/cpu/bugs.c
    +++ b/arch/x86/kernel/cpu/bugs.c
    @@ -10,6 +10,7 @@
    #include <linux/init.h>
    #include <linux/utsname.h>
    #include <linux/cpu.h>
    +#include <linux/module.h>

    #include <asm/nospec-branch.h>
    #include <asm/cmdline.h>
    @@ -155,6 +156,19 @@ static const char *spectre_v2_strings[]
    #define pr_fmt(fmt) "Spectre V2 mitigation: " fmt

    static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE;
    +static bool spectre_v2_bad_module;
    +
    +#ifdef RETPOLINE
    +bool retpoline_module_ok(bool has_retpoline)
    +{
    + if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline)
    + return true;
    +
    + pr_err("System may be vunerable to spectre v2\n");
    + spectre_v2_bad_module = true;
    + return false;
    +}
    +#endif

    static void __init spec2_print_if_insecure(const char *reason)
    {
    @@ -340,6 +354,7 @@ ssize_t cpu_show_spectre_v2(struct devic
    if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2))
    return sprintf(buf, "Not affected\n");

    - return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]);
    + return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled],
    + spectre_v2_bad_module ? " - vulnerable module loaded" : "");
    }
    #endif
    --- a/include/linux/module.h
    +++ b/include/linux/module.h
    @@ -656,4 +656,13 @@ static inline void module_bug_finalize(c
    static inline void module_bug_cleanup(struct module *mod) {}
    #endif /* CONFIG_GENERIC_BUG */

    +#ifdef RETPOLINE
    +extern bool retpoline_module_ok(bool has_retpoline);
    +#else
    +static inline bool retpoline_module_ok(bool has_retpoline)
    +{
    + return true;
    +}
    +#endif
    +
    #endif /* _LINUX_MODULE_H */
    --- a/kernel/module.c
    +++ b/kernel/module.c
    @@ -2494,6 +2494,15 @@ static int elf_header_check(struct load_
    return 0;
    }

    +static void check_modinfo_retpoline(struct module *mod, struct load_info *info)
    +{
    + if (retpoline_module_ok(get_modinfo(info, "retpoline")))
    + return;
    +
    + pr_warn("%s: loading module not compiled with retpoline compiler.\n",
    + mod->name);
    +}
    +
    /* Sets info->hdr and info->len. */
    static int copy_module_from_user(const void __user *umod, unsigned long len,
    struct load_info *info)
    @@ -2698,6 +2707,8 @@ static int check_modinfo(struct module *
    if (!get_modinfo(info, "intree"))
    add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);

    + check_modinfo_retpoline(mod, info);
    +
    if (get_modinfo(info, "staging")) {
    add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
    pr_warn("%s: module is from the staging directory, the quality "
    --- a/scripts/mod/modpost.c
    +++ b/scripts/mod/modpost.c
    @@ -1952,6 +1952,14 @@ static void add_intree_flag(struct buffe
    buf_printf(b, "\nMODULE_INFO(intree, \"Y\");\n");
    }

    +/* Cannot check for assembler */
    +static void add_retpoline(struct buffer *b)
    +{
    + buf_printf(b, "\n#ifdef RETPOLINE\n");
    + buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n");
    + buf_printf(b, "#endif\n");
    +}
    +
    static void add_staging_flag(struct buffer *b, const char *name)
    {
    static const char *staging_dir = "drivers/staging";
    @@ -2282,6 +2290,7 @@ int main(int argc, char **argv)

    add_header(&buf, mod);
    add_intree_flag(&buf, !external_module);
    + add_retpoline(&buf);
    add_staging_flag(&buf, mod->name);
    err |= add_versions(&buf, mod);
    add_depends(&buf, mod, modules);
    \
     
     \ /
      Last update: 2018-03-12 04:11    [W:4.245 / U:0.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site