path: root/kernel/module.c
diff options
authorAndi Kleen <ak@linux.intel.com>2018-01-25 15:50:28 -0800
committerThomas Gleixner <tglx@linutronix.de>2018-01-26 15:03:56 +0100
commitcaf7501a1b4ec964190f31f9c3f163de252273b8 (patch)
treef626e796eb8f30eca268595ca07dc90e00b06ec3 /kernel/module.c
parentc940a3fb1e2e9b7d03228ab28f375fb5a47ff699 (diff)
module/retpoline: Warn about missing retpoline in module
There's a risk that a kernel which has full retpoline mitigations becomes vulnerable when a module gets loaded that hasn't been compiled with the right compiler or the right option. To enable detection of that mismatch at module load time, add a module info string "retpoline" at build time when the module was compiled with retpoline support. This only covers compiled C source, but assembler source or prebuilt object files are not checked. If a retpoline enabled kernel detects a non retpoline protected module at load time, print a warning and report it in the sysfs vulnerability file. [ tglx: Massaged changelog ] Signed-off-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Thomas Gleixner <tglx@linutronix.de> Cc: David Woodhouse <dwmw2@infradead.org> Cc: gregkh@linuxfoundation.org Cc: torvalds@linux-foundation.org Cc: jeyu@kernel.org Cc: arjan@linux.intel.com Link: https://lkml.kernel.org/r/20180125235028.31211-1-andi@firstfloor.org
Diffstat (limited to 'kernel/module.c')
1 files changed, 11 insertions, 0 deletions
diff --git a/kernel/module.c b/kernel/module.c
index de66ec825992..690c0651c40f 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2855,6 +2855,15 @@ static int check_modinfo_livepatch(struct module *mod, struct load_info *info)
+static void check_modinfo_retpoline(struct module *mod, struct load_info *info)
+ if (retpoline_module_ok(get_modinfo(info, "retpoline")))
+ return;
+ pr_warn("%s: loading module not compiled with retpoline compiler.\n",
+ mod->name);
/* Sets info->hdr and info->len. */
static int copy_module_from_user(const void __user *umod, unsigned long len,
struct load_info *info)
@@ -3021,6 +3030,8 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags)
add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK);
+ check_modinfo_retpoline(mod, info);
if (get_modinfo(info, "staging")) {
add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK);
pr_warn("%s: module is from the staging directory, the quality "

Privacy Policy