* Alan Cox <gnomes@xxxxxxxxxxxxxxxxxxx> wrote: > On Mon, 8 Jan 2018 11:08:36 +0100 > Peter Zijlstra <peterz@xxxxxxxxxxxxx> wrote: > > > On Fri, Jan 05, 2018 at 10:30:16PM -0800, Dan Williams wrote: > > > On Fri, Jan 5, 2018 at 6:22 PM, Eric W. Biederman <ebiederm@xxxxxxxxxxxx> wrote: > > > > In at least one place (mpls) you are patching a fast path. Compile out > > > > or don't load mpls by all means. But it is not acceptable to change the > > > > fast path without even considering performance. > > > > > > Performance matters greatly, but I need help to identify a workload > > > that is representative for this fast path to see what, if any, impact > > > is incurred. Even better is a review that says "nope, 'index' is not > > > subject to arbitrary userspace control at this point, drop the patch." > > > > I think we're focussing a little too much on pure userspace. That is, we > > should be saying under the attackers control. Inbound network packets > > could equally be under the attackers control. > > Inbound network packets don't come with a facility to read back and do > cache timimg. [...] But the reply packets can be measured on the sending side, and the total delay timing would thus carry the timing information. Yes, a lot of noise gets added that way if we think 'packet goes through the Internet' - but with gigabit local network access or even through localhost access a lot of noise can be removed as well. It's not as dangerous as a near instantaneous local attack, but 'needs a day of runtime to brute-force through localhost or 10GigE' is still worrying in many real-world security contexts. So I concur with Peter that we should generally consider making all of our responses to external data (maybe with the exception of pigeon post messages) Spectre-safe. Thanks, Ingo
