linux-kernel - Re: [PATCH] objtool: Improve UACCESS coverage

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+icZUUauLqH8JL6NNA2WZHByOLvTSboSN8CxF0RYOpwSfi4jw@mail.gmail.com>
Date:   Wed, 24 Jul 2019 20:32:27 +0200
From:   Sedat Dilek <sedat.dilek@...il.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Josh Poimboeuf <jpoimboe@...hat.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Nathan Chancellor <natechancellor@...il.com>,
        clang-built-linux <clang-built-linux@...glegroups.com>,
        x86@...nel.org, Arnd Bergmann <arnd@...db.de>,
        Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] objtool: Improve UACCESS coverage

On Wed, Jul 24, 2019 at 8:30 PM Sedat Dilek <sedat.dilek@...il.com> wrote:
>
> On Wed, Jul 24, 2019 at 6:48 PM Peter Zijlstra <peterz@...radead.org> wrote:
> >
> > On Wed, Jul 24, 2019 at 04:10:40PM +0200, Peter Zijlstra wrote:
> > > And that most certainly should trigger...
> > >
> > > Let me gdb that objtool thing.
> >
> > ---
> > Subject: objtool: Improve UACCESS coverage
> >
> > A clang build reported an (obvious) double CLAC while a GCC build did
> > not; it turns out we only re-visit instructions if the first visit was
> > with AC=0. If OTOH the first visit was with AC=1, we completely ignore
> > any subsequent visit, even when it has AC=0.
> >
> > Fix this by using a visited mask, instead of boolean and (explicitly)
> > mark the AC state.
> >
> > $ ./objtool check -b --no-fp --retpoline --uaccess ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool: .altinstr_replacement+0x22: redundant UACCESS disable
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   eb_copy_relocations.isra.34()+0xea: (alt)
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   .altinstr_replacement+0xffffffffffffffff: (branch)
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   eb_copy_relocations.isra.34()+0xd9: (alt)
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   eb_copy_relocations.isra.34()+0xb2: (branch)
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   eb_copy_relocations.isra.34()+0x39: (branch)
> > ../../defconfig-build/drivers/gpu/drm/i915/gem/i915_gem_execbuffer.o: warning: objtool:   eb_copy_relocations.isra.34()+0x0: <=== (func)
> >
> > Reported-by: Josh Poimboeuf <jpoimboe@...hat.com>
> > Reported-by: Thomas Gleixner <tglx@...utronix.de>
> > Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
>
> Thanks Peter Z. and Josh P.!
>
> Reported-by: Sedat Dilek <sedat.dilek@...il.com>
> Tested-by: Sedat Dilek <sedat.dilek@...il.com>

Please, add this reference:

Link: https://github.com/ClangBuiltLinux/linux/issues/617

> [1] https://github.com/ClangBuiltLinux/linux/issues/617
>
> > ---
> >  tools/objtool/check.c | 7 ++++---
> >  tools/objtool/check.h | 3 ++-
> >  2 files changed, 6 insertions(+), 4 deletions(-)
> >
> > diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> > index 5f26620f13f5..176f2f084060 100644
> > --- a/tools/objtool/check.c
> > +++ b/tools/objtool/check.c
> > @@ -1946,6 +1946,7 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
> >         struct alternative *alt;
> >         struct instruction *insn, *next_insn;
> >         struct section *sec;
> > +       u8 visited;
> >         int ret;
> >
> >         insn = first;
> > @@ -1972,12 +1973,12 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
> >                         return 1;
> >                 }
> >
> > +               visited = 1 << state.uaccess;
> >                 if (insn->visited) {
> >                         if (!insn->hint && !insn_state_match(insn, &state))
> >                                 return 1;
> >
> > -                       /* If we were here with AC=0, but now have AC=1, go again */
> > -                       if (insn->state.uaccess || !state.uaccess)
> > +                       if (insn->visited & visited)
> >                                 return 0;
> >                 }
> >
> > @@ -2024,7 +2025,7 @@ static int validate_branch(struct objtool_file *file, struct symbol *func,
> >                 } else
> >                         insn->state = state;
> >
> > -               insn->visited = true;
> > +               insn->visited |= visited;
> >
> >                 if (!insn->ignore_alts) {
> >                         bool skip_orig = false;
> > diff --git a/tools/objtool/check.h b/tools/objtool/check.h
> > index b881fafcf55d..6d875ca6fce0 100644
> > --- a/tools/objtool/check.h
> > +++ b/tools/objtool/check.h
> > @@ -33,8 +33,9 @@ struct instruction {
> >         unsigned int len;
> >         enum insn_type type;
> >         unsigned long immediate;
> > -       bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts;
> > +       bool alt_group, dead_end, ignore, hint, save, restore, ignore_alts;
> >         bool retpoline_safe;
> > +       u8 visited;
> >         struct symbol *call_dest;
> >         struct instruction *jump_dest;
> >         struct instruction *first_jump_src;