From mboxrd@z Thu Jan 1 00:00:00 1970 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755122AbeAMPh6 (ORCPT + 1 other); Sat, 13 Jan 2018 10:37:58 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:34608 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754956AbeAMPh5 (ORCPT ); Sat, 13 Jan 2018 10:37:57 -0500 Date: Sat, 13 Jan 2018 16:37:57 +0100 From: Greg KH To: "Van De Ven, Arjan" Cc: Andi Kleen , "tglx@linutronix.de" , "dwmw@amazon.co.uk" , "torvalds@linux-foundation.org" , "linux-kernel@vger.kernel.org" , "peterz@infradead.org" , Andi Kleen , "jeyu@kernel.org" Subject: Re: [PATCH] retpoline/module: Taint kernel for missing retpoline in module Message-ID: <20180113153757.GB25956@kroah.com> References: <20180112175507.31750-1-andi@firstfloor.org> <20180113141209.GA13015@kroah.com> <0575AF4FD06DD142AD198903C74E1CC87A5C9013@FMSMSX151.amr.corp.intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0575AF4FD06DD142AD198903C74E1CC87A5C9013@FMSMSX151.amr.corp.intel.com> User-Agent: Mutt/1.9.2 (2017-12-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Return-Path: On Sat, Jan 13, 2018 at 02:38:51PM +0000, Van De Ven, Arjan wrote: > > > When the a module hasn't been compiled with a retpoline > > > aware compiler, print a warning and set a taint flag. > > > > Isn't that caught by the "build with a different compiler/version" check > > that we have? Or used to have? If not, can't we just make it into that > > type of check to catch this type of problem no matter what type of > > feature/option it is trying to catch? > > > making retpoline part of the modversion hash thingy could make sense. > > but I kinda feel this is a bit overkill; it's not a function issue if > you get this wrong, and if you run an ancient or weird out of tree > module there's a real chance you have other security fun as well ;-) Sure, but take pity on the crazy distro developers who have to support crap like this. They really want to know if a module is built differently from the kernel, to force the user to know they are on their own. modversion seems like a trivial thing to mix this into, and solves the distro issue at the same time. thanks, greg k-h