linux-kernel - [RFC][PATCH 7/9] jump_label,objtool: Validate variable size jump labels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191007090012.17501722.9@infradead.org>
Date:   Mon, 07 Oct 2019 10:44:50 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     x86@...nel.org
Cc:     peterz@...radead.org, linux-kernel@...r.kernel.org,
        rostedt@...dmis.org, mhiramat@...nel.org, bristot@...hat.com,
        jbaron@...mai.com, torvalds@...ux-foundation.org,
        tglx@...utronix.de, mingo@...nel.org, namit@...are.com,
        hpa@...or.com, luto@...nel.org, ard.biesheuvel@...aro.org,
        jpoimboe@...hat.com, hjl.tools@...il.com
Subject: [RFC][PATCH 7/9] jump_label,objtool: Validate variable size jump labels

Since variable sized jump_label support is somewhat 'inspired', ensure
objtool validates the tricky bits. Specifically it is important that
the displacement for the 2 byte jump is limited to a single byte --
since this is the hardest part of the whole scheme and relies on
somewhat dodgy GAS tricks.

Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
Cc: "H.J. Lu" <hjl.tools@...il.com>
---
 tools/objtool/check.c |   26 +++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -817,8 +817,32 @@ static int handle_jump_alt(struct objtoo
 			   struct instruction *orig_insn,
 			   struct instruction **new_insn)
 {
-	if (orig_insn->type == INSN_NOP)
+	if ((orig_insn->len != 2) && (orig_insn->len != 5)) {
+		WARN_FUNC("jump_label: unsupported INSN length: %d",
+				orig_insn->sec, orig_insn->offset, orig_insn->len);
+		return -1;
+	}
+
+	if (orig_insn->type == INSN_NOP) {
+		long disp;
+
+		if (orig_insn->len == 2) {
+			if (special_alt->orig_sec != special_alt->new_sec) {
+				WARN_FUNC("jump_label: JMP8 crossing sections",
+						orig_insn->sec, orig_insn->offset);
+				return -1;
+			}
+
+			disp = special_alt->new_off - (special_alt->orig_off + 2);
+			if ((disp >> 31) != (disp >> 7)) {
+				WARN_FUNC("jump_label: JMP8 displacement not a byte",
+						orig_insn->sec, orig_insn->offset);
+				return -1;
+			}
+		}
+
 		return 0;
+	}
 
 	if (orig_insn->type != INSN_JUMP_UNCONDITIONAL) {
 		WARN_FUNC("unsupported instruction at jump label",