diff options
author | Andi Kleen <ak@linux.intel.com> | 2018-01-25 15:50:28 -0800 |
---|---|---|
committer | Ben Hutchings <ben@decadent.org.uk> | 2018-03-19 18:58:35 +0000 |
commit | 8e871207e06c72304f63447afc022668dc874011 (patch) | |
tree | b183cdbf27e11c5f98118fc0544665bbd4ec212f | |
parent | b36b29d519821c7a43f2257dcd33e687d5c2e61f (diff) | |
download | linux-stable-8e871207e06c72304f63447afc022668dc874011.tar.gz linux-stable-8e871207e06c72304f63447afc022668dc874011.tar.bz2 linux-stable-8e871207e06c72304f63447afc022668dc874011.zip |
module/retpoline: Warn about missing retpoline in module
commit caf7501a1b4ec964190f31f9c3f163de252273b8 upstream.
There's a risk that a kernel which has full retpoline mitigations becomes
vulnerable when a module gets loaded that hasn't been compiled with the
right compiler or the right option.
To enable detection of that mismatch at module load time, add a module info
string "retpoline" at build time when the module was compiled with
retpoline support. This only covers compiled C source, but assembler source
or prebuilt object files are not checked.
If a retpoline enabled kernel detects a non retpoline protected module at
load time, print a warning and report it in the sysfs vulnerability file.
[ tglx: Massaged changelog ]
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: gregkh@linuxfoundation.org
Cc: torvalds@linux-foundation.org
Cc: jeyu@kernel.org
Cc: arjan@linux.intel.com
Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
-rw-r--r-- | arch/x86/kernel/cpu/bugs.c | 17 | ||||
-rw-r--r-- | include/linux/module.h | 9 | ||||
-rw-r--r-- | kernel/module.c | 11 | ||||
-rw-r--r-- | scripts/mod/modpost.c | 9 |
4 files changed, 45 insertions, 1 deletions
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index a61b78590126..8838d31841f3 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -10,6 +10,7 @@ #include <linux/init.h> #include <linux/utsname.h> #include <linux/cpu.h> +#include <linux/module.h> #include <asm/nospec-branch.h> #include <asm/cmdline.h> @@ -235,6 +236,19 @@ static const char *spectre_v2_strings[] = { #define pr_fmt(fmt) "Spectre V2 mitigation: " fmt static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; +static bool spectre_v2_bad_module; + +#ifdef RETPOLINE +bool retpoline_module_ok(bool has_retpoline) +{ + if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline) + return true; + + pr_err("System may be vunerable to spectre v2\n"); + spectre_v2_bad_module = true; + return false; +} +#endif static void __init spec2_print_if_insecure(const char *reason) { @@ -420,6 +434,7 @@ ssize_t cpu_show_spectre_v2(struct sysdev_class *dev, if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) return sprintf(buf, "Not affected\n"); - return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]); + return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled], + spectre_v2_bad_module ? " - vulnerable module loaded" : ""); } #endif diff --git a/include/linux/module.h b/include/linux/module.h index 3cb7839a60b9..509e8ad69f40 100644 --- a/include/linux/module.h +++ b/include/linux/module.h @@ -661,4 +661,13 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr, static inline void module_bug_cleanup(struct module *mod) {} #endif /* CONFIG_GENERIC_BUG */ +#ifdef RETPOLINE +extern bool retpoline_module_ok(bool has_retpoline); +#else +static inline bool retpoline_module_ok(bool has_retpoline) +{ + return true; +} +#endif + #endif /* _LINUX_MODULE_H */ diff --git a/kernel/module.c b/kernel/module.c index 8d2f37d7a75d..7bc1aed0d07f 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -2335,6 +2335,15 @@ static inline void kmemleak_load_module(const struct module *mod, } #endif +static void check_modinfo_retpoline(struct module *mod, struct load_info *info) +{ + if (retpoline_module_ok(get_modinfo(info, "retpoline"))) + return; + + pr_warn("%s: loading module not compiled with retpoline compiler.\n", + mod->name); +} + /* Sets info->hdr and info->len. */ static int copy_and_check(struct load_info *info, const void __user *umod, unsigned long len, @@ -2495,6 +2504,8 @@ static int check_modinfo(struct module *mod, struct load_info *info) if (!get_modinfo(info, "intree")) add_taint_module(mod, TAINT_OOT_MODULE); + check_modinfo_retpoline(mod, info); + if (get_modinfo(info, "staging")) { add_taint_module(mod, TAINT_CRAP); printk(KERN_WARNING "%s: module is from the staging directory," diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c index 2a2fc53d78bd..cd23f828e1eb 100644 --- a/scripts/mod/modpost.c +++ b/scripts/mod/modpost.c @@ -1889,6 +1889,14 @@ static void add_intree_flag(struct buffer *b, int is_intree) buf_printf(b, "\nMODULE_INFO(intree, \"Y\");\n"); } +/* Cannot check for assembler */ +static void add_retpoline(struct buffer *b) +{ + buf_printf(b, "\n#ifdef RETPOLINE\n"); + buf_printf(b, "MODULE_INFO(retpoline, \"Y\");\n"); + buf_printf(b, "#endif\n"); +} + static void add_staging_flag(struct buffer *b, const char *name) { static const char *staging_dir = "drivers/staging"; @@ -2210,6 +2218,7 @@ int main(int argc, char **argv) add_header(&buf, mod); add_intree_flag(&buf, !external_module); + add_retpoline(&buf); add_staging_flag(&buf, mod->name); err |= add_versions(&buf, mod); add_depends(&buf, mod, modules); |