Re: [PATCH] retpoline/module: Taint kernel for missing retpoline in module

[David Woodhouse]

On Mon, 2018-01-15 at 12:53 +0000, Van De Ven, Arjan wrote:
> 
> binary what? ;-)
> 
> retpoline (or lack thereof) is part of the kernel ABI at this point....Â

Strictly speaking, only lack thereof.

If you build the kernel without CONFIG_RETPOLINE, you can't build
modules with retpoline and then expect them to load â because the thunk
symbols aren't exported.

If you build the kernel with the retpoline though, you *can*
successfully load modules which aren't built with retpoline.

It's not even that unlikely, if the kernel engineers are ensuring they
have the latest unreleased toolchain for kernel builds, but you're
using out-of-tree modules built separately or even on the target system
using DKMS, and you *haven't* got the shiny new compiler.

That's what Andi's attempting to protect against.

Attachment: smime.p7s
Description: S/MIME cryptographic signature