linux-kernel - Re: [PATCH] recordmcount: avoid using ABS symbol as reference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 7 Jun 2021 14:59:48 +0800
From:   Mark-PK Tsai <mark-pk.tsai@...iatek.com>
To:     <ardb@...nel.org>
CC:     <linux-arm-kernel@...ts.infradead.org>,
        <linux-kernel@...r.kernel.org>,
        <linux-mediatek@...ts.infradead.org>, <mark-pk.tsai@...iatek.com>,
        <matthias.bgg@...il.com>, <mhelsley@...are.com>,
        <rostedt@...dmis.org>, <samitolvanen@...gle.com>,
        <yj.chiang@...iatek.com>
Subject: Re: [PATCH] recordmcount: avoid using ABS symbol as reference

> > On Mon, 7 Jun 2021 at 04:42, Mark-PK Tsai <mark-pk.tsai@...iatek.com> wrote:
> >
> > Avoid using ABS symbol, which won't be relocate, as reference.
> >
> > On arm64 platform, if there's shndx equals SHN_ABS(0xfff1).
> >
> > Section Headers:
> > [Nr]    Name                         Type      Address          Off      Size   ES  Flg Lk     Inf    Al
> > [65521] .text.n_tty_receive_buf      PROGBITS  0000000000000000 3cdab520 000054 00  AX  0      0      4
> > [65522] .rela.text.n_tty_receive_buf RELA      0000000000000000 3cdab578 000030 18  I   152076 65521  8
> >
>
> A RELA section's r_info field points to the section to which it
> applies. This is why in the example above section #65522 points to
> section #65521. This has nothing to do with the numerical value of
> SHN_ABS.

If the r_info of RELA section is 65521(0xfff1),
find_secsym_ndx() will use it to find the base symbol.

And in the symbol search loop in find_secsym_ndx(), get_symindex will
return 0xfff1 if the symbol is in ABS section.

In this case, find_secsym_ndx() will return a absolute symbol as
base, which won't be relocate, if an ABS symbol is found before the
real symbol in section 65521.

>
> > find_secsym_ndx, which use r_info in rela section to find the reference
> > symbol, may take ABS symbol as base.
> >
> > Symbol table '.symtab' contains 453285 entries:
> >    Num:    Value          Size Type    Bind   Vis       Ndx Name
> >      6: 0000000000000002     0 NOTYPE  LOCAL  DEFAULT   ABS section_count
> >
> > Which cause an invalid address in __mcount_loc.
> >
>
> Could you give a better account of the error you are trying to address?
>
> Also, arm64 no longer defines a section_count symbol (since v5.11), so
> please make sure that the diagnostics of the issue you are addressing
> are accurate for mainline.
>

My kernel version is 5.4.61.
But as I explained, I suppose mainline also have this issue.

>
> > Signed-off-by: Mark-PK Tsai <mark-pk.tsai@...iatek.com>
> > ---
> >  scripts/recordmcount.h | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
> > index f9b19524da11..9b69167fb7ff 100644
> > --- a/scripts/recordmcount.h
> > +++ b/scripts/recordmcount.h
> > @@ -526,6 +526,10 @@ static int find_secsym_ndx(unsigned const txtndx,
> >         for (symp = sym0, t = nsym; t; --t, ++symp) {
> >                 unsigned int const st_bind = ELF_ST_BIND(symp->st_info);
> >
> > +               /* avoid absolute symbols */
> > +               if (symp->st_shndx == SHN_ABS)
> > +                       continue;
> > +
> >                 if (txtndx == get_symindex(symp, symtab, symtab_shndx)
> >                         /* avoid STB_WEAK */
> >                     && (STB_LOCAL == st_bind || STB_GLOBAL == st_bind)) {