linux-kernel - Re: linux-next: Tree for Mar 18 (objtool)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 18 Mar 2020 21:05:42 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     Randy Dunlap <rdunlap@...radead.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Kees Cook <keescook@...omium.org>
Subject: Re: linux-next: Tree for Mar 18 (objtool)

On Wed, Mar 18, 2020 at 01:23:52PM -0500, Josh Poimboeuf wrote:
> On Wed, Mar 18, 2020 at 09:48:01AM -0700, Randy Dunlap wrote:
> > On 3/18/20 4:09 AM, Stephen Rothwell wrote:
> > > Hi all,
> > > 
> > > Changes since 20200317:
> > > 
> > 
> > Hi,
> > 
> > For some reason, the attached .config file generates over 350 objtool warnings.
> > There are all "unreachable instruction" warnings.
> > 
> > Here is a small sample:
> > 
> > mm/page-writeback.o: warning: objtool: __set_page_dirty_nobuffers()+0x25b: unreachable instruction
> > kernel/sched/fair.o: warning: objtool: load_balance()+0x54c: unreachable instruction
> > kernel/power/process.o: warning: objtool: freeze_kernel_threads()+0x115: unreachable instruction
> > mm/readahead.o: warning: objtool: read_cache_pages_invalidate_page()+0x1b5: unreachable instruction
> > kernel/power/suspend.o: warning: objtool: suspend_devices_and_enter()+0x101f: unreachable instruction
> > kernel/sched/rt.o: warning: objtool: dequeue_top_rt_rq()+0x67: unreachable instruction
> 
> This seems to be caused by 
> 
>   545ed6816b72 ("ubsan: add trap instrumentation option")
> 
> Kees, any idea why that commit causes at least some BUG() statements to
> output an extra UD2?

"Built-in Function: void __builtin_trap (void)

    This function causes the program to exit abnormally. GCC implements
    this function by using a target-dependent mechanism (such as
    intentionally executing an illegal instruction) or by calling abort.
    The mechanism used may vary from release to release so you should
    not rely on any particular implementation."

Sounds encouraging :-(

Clearly it now emits UD2, but who knows what it'll do next week.

I think what happens is that we have code that does:

	if (cond)
		BUG()/WARN()

And ubsan figures that @cond is something undefined, and then we get
transformed into:

	if (cond) {
		__builtin_trap();
		BUG()/WARN()
	}

And presto, double UD2.

Since x86 has GENERIC_BUG unconditionally, we should actually have
__bug_table entries for each BUG()/WARN() instance, which should allow
us to distinguish between a proper BUG()/WARN() and this
__builtin_trap() nonsense.