linux-kernel - Re: [PATCH v3 16/16] objtool,x86: Rewrite retpoline thunk calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210607172311.ynnrzihgz74vdyjq@google.com>
Date:   Mon, 7 Jun 2021 10:23:11 -0700
From:   Fāng-ruì Sòng <maskray@...gle.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     Nick Desaulniers <ndesaulniers@...gle.com>,
        Josh Poimboeuf <jpoimboe@...hat.com>, lma@...ihalf.com,
        Guenter Roeck <groeck@...gle.com>,
        Juergen Gross <jgross@...e.com>, lb@...ihalf.com,
        LKML <linux-kernel@...r.kernel.org>, mbenes@...e.com,
        Radosław Biernacki <rad@...ihalf.com>,
        upstream@...ihalf.com,
        "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" <x86@...nel.org>,
        clang-built-linux <clang-built-linux@...glegroups.com>,
        Nathan Chancellor <nathan@...nel.org>,
        Sami Tolvanen <samitolvanen@...gle.com>
Subject: Re: [PATCH v3 16/16] objtool,x86: Rewrite retpoline thunk calls

On 2021-06-07, Peter Zijlstra wrote:
>On Mon, Jun 07, 2021 at 11:22:11AM +0200, Peter Zijlstra wrote:
>> On Mon, Jun 07, 2021 at 09:56:48AM +0200, Peter Zijlstra wrote:
>> > On Sat, Jun 05, 2021 at 06:58:39PM -0700, Fāng-ruì Sòng wrote:
>> > > On Sat, Jun 5, 2021 at 3:39 AM Peter Zijlstra <peterz@...radead.org> wrote:
>> >
>> > > > I think you've absolutely nailed it; but would you have more information
>> > > > or a code reference to what you're speaking about? My complete ELF
>> > > > and libelf knowledge is very limited and as demonstrated here, I'm not
>> > > > at all sure how all that extended index stuff is supposed to work.
>> > >
>> > > The section index field of an Elf{32,64}_Sym (st_shndx) is 16-bit, so
>> > > it cannot represent a section index greater than 0xffff.
>> > > ELF actually reserves values in 0xff00~0xff00 for other purposes, so
>> > > st_shndx cannot represent a section whose index is greater or equal to
>> > > 0xff00.
>> >
>> > Right, that's about as far as I got, but never could find details on how
>> > the extension worked in detail, and I clearly muddled it :/
>>
>> OK, so I'm all confused again...
>>
>> So a .symtab entry has:
>>
>> 	st_name  -- strtab offset for the name string
>> 	st_value -- where this symbol lives
>> 	st_size  -- size of symbol in bytes
>> 	st_shndx -- section index to interpret the @st_value above
>> 	st_info  -- type+bind
>> 	st_other -- visibility
>>
>> The thing is, we're adding UNDEF symbols, for the linker to resolve.
>> UNDEF has:
>>
>> 	st_value := 0
>> 	st_size  := 0
>> 	st_shndx := 0
>> 	st_info  := GLOBAL + NOTYPE
>> 	st_other := 0
>>
>> Per that, sh_shndx isn't >= SHN_LORESERVE, and I figured we all good.
>>
>>
>> Is the problem that .symtab_shndx is expected to contain the exact same
>> number of entries as .symtab? And I'm adding to .symtab and not to
>> .symtab_shndx, hence getting them out of sync?

Yes. http://www.sco.com/developers/gabi/latest/ch4.sheader.html says
"Each value corresponds one to one with a symbol table entry and appear in the same order as those entries."

>> Let me try adding 0s to .symtab_shndx. See if that makes readelf
>> happier.
>
>That does indeed seem to do the trick. Bit daft if you ask me, anybody
>reading that file ought to have a handy bucket of 0s available, but
>whatever.

Does the representation use the section index directly? (sym->sym.st_shndx)
This can be fragile when the number of sections changes..., e.g. elf_add_section

So in llvm-objcopy's representation, the section index is represented as
the section object.

struct Symbol {
   ...
   SectionBase *DefinedIn = nullptr;
   ...
};

In the writer stage, sections are assigned 32-bit indexes and the writer
knows that an SHN_XINDEX for a symbol is needed if the index is >= 0xff00.

>---
> tools/objtool/elf.c | 25 ++++++++++++++++++++++++-
> 1 file changed, 24 insertions(+), 1 deletion(-)
>
>diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
>index 743c2e9d0f56..41bca1d13d8e 100644
>--- a/tools/objtool/elf.c
>+++ b/tools/objtool/elf.c
>@@ -717,7 +717,7 @@ static int elf_add_string(struct elf *elf, struct section *strtab, char *str)
>
> struct symbol *elf_create_undef_symbol(struct elf *elf, const char *name)
> {
>-	struct section *symtab;
>+	struct section *symtab, *symtab_shndx;
> 	struct symbol *sym;
> 	Elf_Data *data;
> 	Elf_Scn *s;
>@@ -769,6 +769,29 @@ struct symbol *elf_create_undef_symbol(struct elf *elf, const char *name)
> 	symtab->len += data->d_size;
> 	symtab->changed = true;
>
>+	symtab_shndx = find_section_by_name(elf, ".symtab_shndx");
>+	if (symtab_shndx) {
>+		s = elf_getscn(elf->elf, symtab_shndx->idx);
>+		if (!s) {
>+			WARN_ELF("elf_getscn");
>+			return NULL;
>+		}
>+
>+		data = elf_newdata(s);
>+		if (!data) {
>+			WARN_ELF("elf_newdata");
>+			return NULL;
>+		}
>+
>+		data->d_buf = &sym->sym.st_size; /* conveniently 0 */
>+		data->d_size = sizeof(Elf32_Word);
>+		data->d_align = 4;
>+		data->d_type = ELF_T_WORD;
>+
>+		symtab_shndx->len += 4;
>+		symtab_shndx->changed = true;
>+	}
>+
> 	sym->sec = find_section_by_index(elf, 0);
>
> 	elf_add_symbol(elf, sym);