linux-kernel - Re: [PATCH v2 9/9] objtool: Abstract unwind hint reading

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <8fe8199e-a2f3-513f-6cdf-c61d7936dede@redhat.com>
Date:   Tue, 25 Aug 2020 13:31:46 +0100
From:   Julien Thierry <jthierry@...hat.com>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     linux-kernel@...r.kernel.org, peterz@...radead.org, mbenes@...e.cz,
        raphael.gault@....com, benh@...nel.crashing.org
Subject: Re: [PATCH v2 9/9] objtool: Abstract unwind hint reading



On 8/3/20 10:35 PM, Josh Poimboeuf wrote:
> On Mon, Aug 03, 2020 at 01:13:14PM +0100, Julien Thierry wrote:
>>
>>
>> On 7/31/20 3:04 PM, Josh Poimboeuf wrote:
>>> On Fri, Jul 31, 2020 at 08:00:58AM +0100, Julien Thierry wrote:
>>>>>> +	cfa->offset = hint->sp_offset;
>>>>>> +	insn->cfi.hint_type = hint->type;
>>>>>> +	insn->cfi.end = hint->end;
>>>>>> +
>>>>>> +	insn->cfi.sp_only = hint->type == ORC_TYPE_REGS || hint->type == ORC_TYPE_REGS_IRET;
>>>>>
>>>>> What does "sp" mean here in sp_only?
>>>>>
>>>>
>>>> Stack pointer, like in CFI_SP. When objtool encounters one of these hints,
>>>> it starts to only track the stack frame with the stack pointer (no BP, no
>>>> drap register, no move to temporary registers). Just trying to make some
>>>> sense of this corner case.
>>>
>>> I think that's not quite right, because ORC_TYPE_CALL could also be
>>> "sp_only" in some cases, by that definition.
>>>
>>
>> But in that case the code will still track when/if the CFI becomes pointed
>> to by BP.
>>
>>> The call to update_cfi_state_regs() is really regs-specific, not
>>> sp-specific.
>>>
>>
>> I must admit I don't really understand what "regs" is and why exactly such
>> an exception in stack state tracking is made where only operations to SP are
>> taken into account.
> 
> "regs" is a special type of stack frame, usually for asm entry code,
> where the frame is actually an instance of 'struct pt_regs'.  So if
> there's a variable associated it with it, maybe it should have "regs" in
> the name.
> 
> Though I think non-x86 arches will also have regs frames, so would it
> make sense to just make the unwind hint types a global multiarch thing?
> They could be renamed to UNWIND_HINT_TYPE_REGS{_PARTIAL}.  Then there
> wouldn't really be a need for the "sp_only" thing.
> 

If having regs frame means having a pt_regs on the stack when procedure 
calls/return, then yes this will probably be the case on most archs (it 
is for arm64 at least.

However in that case, arm64 still builds a stack frame and sets the 
frame pointer, so only handling SP operations doesn't make much sense 
for arm64.

Also, things like ORC_TYPE_REGS_IRET don't have a use for arm64 (but 
maybe for other non-x86 arches it does?)

In the end that's why I left the unwind hint types as arch defined. It 
seems like every arch will have their specific semantics they might want 
to let objtool know about.

-- 
Julien Thierry