linux-kernel - Re: [RFC v4 16/18] arm64: crypto: Add exceptions for crypto object to prevent stack analysis

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 22 Aug 2019 15:19:03 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Raphael Gault <raphael.gault@....com>
Cc:     linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
        peterz@...radead.org, catalin.marinas@....com, will.deacon@....com,
        julien.thierry.kdev@...il.com, raph.gault+kdev@...il.com
Subject: Re: [RFC v4 16/18] arm64: crypto: Add exceptions for crypto object
 to prevent stack analysis

On Fri, Aug 16, 2019 at 01:24:01PM +0100, Raphael Gault wrote:
> Some crypto modules contain `.word` of data in the .text section.
> Since objtool can't make the distinction between data and incorrect
> instruction, it gives a warning about the instruction beeing unknown
> and stops the analysis of the object file.
> 
> The exception can be removed if the data are moved to another section
> or if objtool is tweaked to handle this particular case.
> 
> Signed-off-by: Raphael Gault <raphael.gault@....com>

If the data can be moved to .rodata then I think that would be a much
better solution.

> ---
>  arch/arm64/crypto/Makefile | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile
> index 0435f2a0610e..e2a25919ebaa 100644
> --- a/arch/arm64/crypto/Makefile
> +++ b/arch/arm64/crypto/Makefile
> @@ -43,9 +43,11 @@ aes-neon-blk-y := aes-glue-neon.o aes-neon.o
>  
>  obj-$(CONFIG_CRYPTO_SHA256_ARM64) += sha256-arm64.o
>  sha256-arm64-y := sha256-glue.o sha256-core.o
> +OBJECT_FILES_NON_STANDARD_sha256-core.o := y
>  
>  obj-$(CONFIG_CRYPTO_SHA512_ARM64) += sha512-arm64.o
>  sha512-arm64-y := sha512-glue.o sha512-core.o
> +OBJECT_FILES_NON_STANDARD_sha512-core.o := y
>  
>  obj-$(CONFIG_CRYPTO_CHACHA20_NEON) += chacha-neon.o
>  chacha-neon-y := chacha-neon-core.o chacha-neon-glue.o
> @@ -58,6 +60,7 @@ aes-arm64-y := aes-cipher-core.o aes-cipher-glue.o
>  
>  obj-$(CONFIG_CRYPTO_AES_ARM64_BS) += aes-neon-bs.o
>  aes-neon-bs-y := aes-neonbs-core.o aes-neonbs-glue.o
> +OBJECT_FILES_NON_STANDARD_aes-neonbs-core.o := y
>  
>  CFLAGS_aes-glue-ce.o	:= -DUSE_V8_CRYPTO_EXTENSIONS
>  
> -- 
> 2.17.1
> 

-- 
Josh