linux-kernel - Re: [PATCH] objtool: include symbol value in check for contiguous objects

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 3 May 2021 12:28:14 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Vanessa Hack <vanessa.hack@....de>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        linux-kernel@...r.kernel.org,
        Jonas Rabenstein <rabenstein@...fau.de>
Subject: Re: [PATCH] objtool: include symbol value in check for contiguous
 objects

On Wed, Apr 28, 2021 at 11:04:08PM +0200, Vanessa Hack wrote:
> While trying to adopt objtool's ability to generate ORC data for the use
> in our research project, we came across a problem with the detection of
> function pointers of contiguous objects introduced by commit fd35c88b7417
> ("objtool: Support GCC 8 switch tables"). Only the section and the
> addend/offset of the relocation/function are compared without the actual
> value of the involved symbols - false positives might be reported if the
> referenced symbols are different, but are in the same section. By adding
> (the value of) the referenced symbol as part of the comparison, those
> false positives are no longer reported.
> 
> Co-developed-by: Jonas Rabenstein <rabenstein@...fau.de>
> Signed-off-by: Jonas Rabenstein <rabenstein@...fau.de>
> Signed-off-by: Vanessa Hack <vanessa.hack@....de>
> ---
>  tools/objtool/check.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> index 1f4154f9b04b..4456f3278bb8 100644
> --- a/tools/objtool/check.c
> +++ b/tools/objtool/check.c
> @@ -1320,6 +1320,8 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn,
>  	 * instruction.
>  	 */
>  	list_for_each_entry_from(reloc, &table->sec->reloc_list, list) {
> +		unsigned int pfunc_offset;
> +		unsigned int reloc_offset;
>  
>  		/* Check for the end of the table: */
>  		if (reloc != table && reloc->jump_table_start)
> @@ -1330,8 +1332,10 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn,
>  			break;
>  
>  		/* Detect function pointers from contiguous objects: */
> +		pfunc_offset = pfunc->sym.st_value + pfunc->offset;
> +		reloc_offset = reloc->sym->sym.st_value + reloc->addend;
>  		if (reloc->sym->sec == pfunc->sec &&
> -		    reloc->addend == pfunc->offset)
> +		    pfunc_offset == reloc_offset)
>  			break;

Hi Vanessa & Jonas,

Thanks for the patch!

I'm a little confused about the issue -- do you have an example listing
of .rodata relocations (e.g. from 'readelf -aW') which confused objtool?

I believe add_jump_table() -- in addition to all the other jump table
code -- assumes that reloc->sym is a section symbol (STT_SECTION),
rather than a function symbol (STT_FUNC).  Was it an STT_FUNC symbol
which caused the problem?

Also I'm not quite convinced this patch is the right fix.  For the
'pfunc_offset' calculation, I believe 'pfunc->sym.st_value' is the same
value as 'pfunc->offset' -- they both represent the function's section
offset.  So it's basically adding pfunc->offset to itself, right?  Is
that intentional?

Any chance this patch fixes your issue?  If not, the above readelf would
help me understand it more.

diff --git a/tools/objtool/check.c b/tools/objtool/check.c
index 5e5388a38e2a..4f30a763a4e3 100644
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1344,6 +1344,10 @@ static int add_jump_table(struct objtool_file *file, struct instruction *insn,
 		if (prev_offset && reloc->offset != prev_offset + 8)
 			break;
 
+		/* Jump table relocs are always STT_SECTION: */
+		if (reloc->sym->type != STT_SECTION)
+			break;
+
 		/* Detect function pointers from contiguous objects: */
 		if (reloc->sym->sec == pfunc->sec &&
 		    reloc->addend == pfunc->offset)