Messages in this thread | | | From | Linus Torvalds <> | Date | Mon, 18 Jul 2022 16:42:29 -0700 | Subject | Re: [patch 00/38] x86/retbleed: Call depth tracking mitigation |
| |
On Mon, Jul 18, 2022 at 4:19 PM Thomas Gleixner <tglx@linutronix.de> wrote: > > But that's an implementation detail, right? Whatever we put in between > will still be a fixed offset, no? It's a different offset, but that's > what patching can deal with.
No, what Sami is sayin that because the "cmpl" *inside* the function that checks the hash value will have that same (valid) hash value encoded as part of it, then you actually have *two* valid markers with that hash value.
You have the "real" marker before the function.
But you also have the "false" marker that is part of the hash check that is *inside* the function.
The "real marker + 6" points to the function head itself, and so is ok as a target (normal operation).
The "false marker + 6" points to the "UD2", and so is *also* ok as a target (bad guy trying to mis-use the false marker gets trapped by UD2).
Linus
| |