linux-kernel - Re: [PATCH 00/20] objtool: UACCESS validation v3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190307125526.GB32534@hirez.programming.kicks-ass.net>
Date:   Thu, 7 Mar 2019 13:55:26 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     torvalds@...ux-foundation.org, tglx@...utronix.de, hpa@...or.com,
        julien.thierry@....com, will.deacon@....com, luto@...capital.net,
        mingo@...nel.org, catalin.marinas@....com, james.morse@....com,
        valentin.schneider@....com, brgerst@...il.com, jpoimboe@...hat.com,
        luto@...nel.org, bp@...en8.de, dvlasenk@...hat.com
Cc:     linux-kernel@...r.kernel.org, dvyukov@...gle.com,
        rostedt@...dmis.org
Subject: Re: [PATCH 00/20] objtool: UACCESS validation v3

On Thu, Mar 07, 2019 at 01:03:17PM +0100, Peter Zijlstra wrote:


> 01c3     20d8:	77 08                	ja     20e2 <__do_sys_waitid+0x1cd>

taken:

 randconfig-build/kernel/exit.o: warning: objtool:   __do_sys_waitid()+0x1c3: (branch)

> ffffffffffffe0f5 	alternative("", __stringify(__ASM_STAC), X86_FEATURE_SMAP);
> 01c8     20dd:	90                   	nop
> 01c9     20de:	90                   	nop
> 01ca     20df:	90                   	nop

Bye-bye STAC, jumped straight over.

> 01cd     20e2:	83 f0 01             	xor    $0x1,%eax
> 01d0     20e5:	48 89 c2             	mov    %rax,%rdx
> 01d3     20e8:	83 e2 01             	and    $0x1,%edx
> 01d6     20eb:	48 83 c2 02          	add    $0x2,%rdx
> 01da     20ef:	48 ff 04 d5 00 00 00 	incq   0x0(,%rdx,8)
> 01e1     20f6:	00 
> 01de 			20f3: R_X86_64_32S	_ftrace_branch+0x148
> 01e2     20f7:	84 c0                	test   %al,%al
> 01e4     20f9:	75 2d                	jne    2128 <__do_sys_waitid+0x213>

we do not take this branch and fall-through.

> ffffffffffffe0eb 		return -EFAULT;
> ffffffffffffe0eb 
> ffffffffffffe0eb 	unsafe_put_user(signo, &infop->si_signo, Efault);
> 01e6     20fb:	44 89 33             	mov    %r14d,(%rbx)

fault, take exception:

  randconfig-build/kernel/exit.o: warning: objtool:   __do_sys_waitid()+0x1e6: (alt)

Relocation section '.rela__ex_table' at offset 0x21568 contains 18 entries:
Offset          Info           Type           Sym. Value    Sym. Name + Addend
000000000000  000200000002 R_X86_64_PC32     0000000000000000 .text + 20fb
000000000004  000200000002 R_X86_64_PC32     0000000000000000 .text + 2125

> ffffffffffffefe5 Efault:
> ffffffffffffe0eb 	user_access_end();
> 0210     2125:	90                   	nop
> 0211     2126:	90                   	nop
> 0212     2127:	90                   	nop

 randconfig-build/kernel/exit.o: warning: objtool:   __do_sys_waitid()+0x210: (alt)

000000000034  000200000002 R_X86_64_PC32     0000000000000000 .text + 2125
000000000038  00c800000002 R_X86_64_PC32     0000000000000000 .altinstr_replacement + c

0000000000000000 <.altinstr_replacement>:
c:   0f 01 ca                clac

 randconfig-build/kernel/exit.o: warning: objtool: .altinstr_replacement+0xc: redundant UACCESS disable