[MODERATED] Re: [PATCH v2] Linux Patch 1/1

[Jiri Kosina <jkosina@suse.com>]

On Thu, 3 May 2018, speck for Linus Torvalds wrote:

> This part is probably easyish. BUT:
> 
>  - you have to use a different base pointer for it, which suddenly means 
>    that it's not the obvious case of a stack spill "let's store to the 
>    stack and the load the value back", because that generally uses the 
>    same base pointer unless your code generation is complete garbage.

Fair enough; if gcc is ever generating such code, it should probably be 
better to fix gcc directly anyway.

> So what we should look at is "can you make ebpf easily generate that 
> "store followed by load from same address with a different base 
> register, and can you run it as non-root".

So that's, according to my understanding, the PoC that google folks have 
succesfully created (the only modification AFAIK they did to eBPF is 
allowing more easier cacheline flush from within eBPF), basically let 
otherwise sandboxed process to

- store unsingned long into memory
- store pointer into the same memory location
- load from that location and use it so that the side channel is there 
  (array index), as due to MD the speculative execution observes the
  unsinged long, and not the pointer

And reportedly they succeeded (with the easiser cacheline flush 
modification).

> And I haven't seen anybody actually try to look into that.  Have the ebpf 
> people been involved on this issue at all?

I am not sure if any of them is on this list. Jon, would it be possible to 
drag Daniel Borkmann here?

Thanks,

-- 
Jiri Kosina
SUSE Labs