Re: [PATCH] [RFC] x86: work around MPX Erratum

[Dave Hansen]

On 05/03/2016 02:31 PM, Andy Lutomirski wrote:
> Having actually read the erratum: how can this affect Linux at all
> under any scenario where user code hasn't already completely
> compromised the kernel?
> 
> I.e. why do we care about this erratum?

First of all, with SMEP, it doesn't affect us.  At all.

Without SMEP, there would have to be a page accessible to userspace that
the kernel executes instructions from.  The only thing that I can think
of that's normally user-accessible and not _controlled_ by userspace is
the VDSO.  But the kernel never actually executes from it, so it doesn't
matter here.

I've heard reports of (but no actual cases in the wild of) folks
remapping kernel text to be user-accessible so that userspace can
execute it, or of having the kernel jump into user-provided libraries.
Those are both obviously bonkers and would only be done with out-of-tree
gunk, but even if somebody did that, they would be safe from the
erratum, with this workaround.