linux-kernel - Re: [PATCH v2 12/14] objtool: Allow archs to rewrite retpolines

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YFSJH0/wiHLkteLw@hirez.programming.kicks-ass.net>
Date:   Fri, 19 Mar 2021 12:21:03 +0100
From:   Peter Zijlstra <peterz@...radead.org>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     x86@...nel.org, jgross@...e.com, mbenes@...e.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2 12/14] objtool: Allow archs to rewrite retpolines

On Thu, Mar 18, 2021 at 09:54:40PM -0500, Josh Poimboeuf wrote:
> On Thu, Mar 18, 2021 at 06:11:15PM +0100, Peter Zijlstra wrote:
> > @@ -1212,6 +1225,8 @@ static int handle_group_alt(struct objto
> >  		dest_off = arch_jump_destination(insn);
> >  		if (dest_off == special_alt->new_off + special_alt->new_len)
> >  			insn->jump_dest = next_insn_same_sec(file, last_orig_insn);
> > +		else
> > +			insn->jump_dest = find_insn(file, insn->sec, dest_off);
> >  
> >  		if (!insn->jump_dest) {
> >  			WARN_FUNC("can't find alternative jump destination",
> 
> So I assume this change is because of the ordering change: now this is
> done before add_jump_destinations().

Correct.

> Also the new hunk to be an oversimplified version of
> add_jump_destinations().  I'm not quite convinced that it will always do
> the right thing for this case.

You're right; this is because of the reorder. At the time I thought this
was right, but looking at it now, I'm not sure. Esp. so when ARM64 comes
along and allows more relocations in alternatives.

Let me see if I can come up with something better.

> But doesn't that mean the alternative jump modification (changing the
> dest to the end of the original insns) will get overwritten later?

Good point, should be simple enough to fix by having
add_jump_destination() skip all that already have insn->jump_dest set I
suppose.

> > @@ -1797,11 +1812,15 @@ static int decode_sections(struct objtoo
> >  	if (ret)
> >  		return ret;
> >  
> > -	ret = add_jump_destinations(file);
> > +	/*
> > +	 * Must be before add_{jump,call}_destination; for they can add
> > +	 * magic alternatives.
> > +	 */
> > +	ret = add_special_section_alts(file);
> 
> This reordering is unfortunate.  Maybe there's a better way, though I
> don't have any ideas, at least until I get to the most controversial
> patch.

So the thing no longer crashes on the alternatives it writes, so we
*could* read back our own alternatives, but it does seem somewhat
unfortunate to do that. Too easy to get into cycles that way.