Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758703AbeAIAfe (ORCPT + 1 other); Mon, 8 Jan 2018 19:35:34 -0500 Received: from mail-io0-f172.google.com ([209.85.223.172]:47080 "EHLO mail-io0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754639AbeAIAfc (ORCPT ); Mon, 8 Jan 2018 19:35:32 -0500 X-Google-Smtp-Source: ACJfBov7E/fgVadzBRu9UWaJKjeMTq+67Lk2ZhLwfEEVKdt6Y2bV1kWHHEt5Yn4SFP00NtnI2dZTK2QHBCJ0AOXChyY= MIME-Version: 1.0 In-Reply-To: <1515455902.4423.59.camel@amazon.co.uk> References: <1515363085-4219-1-git-send-email-dwmw@amazon.co.uk> <1515455051.15588.7.camel@infradead.org> <1515455902.4423.59.camel@amazon.co.uk> From: Linus Torvalds Date: Mon, 8 Jan 2018 16:35:31 -0800 X-Google-Sender-Auth: OiYOpG1BO8YpjV11ZsT72zc3hm4 Message-ID: Subject: Re: [PATCH v6 11/10] x86/retpoline: Avoid return buffer underflows on context switch To: "Woodhouse, David" Cc: "linux-kernel@vger.kernel.org" , "tim.c.chen@linux.intel.com" , "peterz@infradead.org" , "tglx@linutronix.de" , "ak@linux.intel.com" , "riel@redhat.com" , "keescook@google.com" , "gnomes@lxorguk.ukuu.org.uk" , "pjt@google.com" , "dave.hansen@intel.com" , "luto@amacapital.net" , "jikos@kernel.org" , "gregkh@linux-foundation.org" Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Mon, Jan 8, 2018 at 3:58 PM, Woodhouse, David wrote: >> >> Is there really nothing more clever we can do? > > You get this part in the IBRS/microcode solution too. The IBRS MSR > doesn't catch everything; you still need to stuff the RSB in very > similar places (and/or use the IBPB MSR in some). So I was really hoping that in places like context switching etc, we'd be able to instead effectively kill off any exploits by clearing registers. That should make it pretty damn hard to then find a matching "gadget" that actually does anything interesting/powerful. Together with Spectre already being pretty hard to take advantage of, and the eBPF people making those user-proivided gadgets inaccessible, it really should be a pretty powerful fix. Hmm? Linus