linux-kernel - Re: [PATCH] recordmcount: avoid using ABS symbol as reference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAMj1kXGCoME4Wy4e3FNAjWLY=G56ivHzFTLrXRE0mLtnaBVEDQ@mail.gmail.com>
Date:   Mon, 7 Jun 2021 11:50:40 +0200
From:   Ard Biesheuvel <ardb@...nel.org>
To:     Mark-PK Tsai <mark-pk.tsai@...iatek.com>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>,
        linux-toolchains@...r.kernel.org
Cc:     Linux ARM <linux-arm-kernel@...ts.infradead.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        linux-mediatek@...ts.infradead.org,
        Matthias Brugger <matthias.bgg@...il.com>,
        Matt Helsley <mhelsley@...are.com>,
        "Steven Rostedt (VMware)" <rostedt@...dmis.org>,
        Sami Tolvanen <samitolvanen@...gle.com>, yj.chiang@...iatek.com
Subject: Re: [PATCH] recordmcount: avoid using ABS symbol as reference

On Mon, 7 Jun 2021 at 10:06, Mark-PK Tsai <mark-pk.tsai@...iatek.com> wrote:
>
> > > On Mon, 7 Jun 2021 at 08:59, Mark-PK Tsai <mark-pk.tsai@...iatek.com> wrote:
> > > >
> > > > > > On Mon, 7 Jun 2021 at 04:42, Mark-PK Tsai <mark-pk.tsai@...iatek.com> wrote:
> > > > > >
> > > > > > Avoid using ABS symbol, which won't be relocate, as reference.
> > > > > >
> > > > > > On arm64 platform, if there's shndx equals SHN_ABS(0xfff1).
> > > > > >
> > > > > > Section Headers:
> > > > > > [Nr]    Name                         Type      Address          Off      Size   ES  Flg Lk     Inf    Al
> > > > > > [65521] .text.n_tty_receive_buf      PROGBITS  0000000000000000 3cdab520 000054 00  AX  0      0      4
> > > > > > [65522] .rela.text.n_tty_receive_buf RELA      0000000000000000 3cdab578 000030 18  I   152076 65521  8
> > > > > >
> > > > >
> > > > > A RELA section's r_info field points to the section to which it
> > > > > applies. This is why in the example above section #65522 points to
> > > > > section #65521. This has nothing to do with the numerical value of
> > > > > SHN_ABS.
> > > >
> > > > If the r_info of RELA section is 65521(0xfff1),
> >
> > Oh sorry, I mean sh_info here.
> >
> > > > find_secsym_ndx() will use it to find the base symbol.
> > > >
> > >
> > > But what does that have to do with the sh_info field of the RELA
> > > section's Elf_Shdr struct? IOW, what is the relevance of section
> > > #65521 here?
> > >
> >
> > So what I mean is the problem occur if the sh_info of a RELA section
> > is #65521.
>
> Actually the problem occur if the sh_info of a RELA section is in
> the special section index range(SHN_LORESERVE ~ SHN_HIRESERVE).
> Maybe I should add a is_shndx_special() to check this like
> scripts/mod/modpost.h did?
>

So if I understand all of this correctly, we are running into a
fundamental issue here, where the linker emits more sections than the
sh_info field can describe, overflowing into the reserved range.

I don't think papering over it like this is going to be maintainable
going forward.



> >
> > > > And in the symbol search loop in find_secsym_ndx(), get_symindex will
> > > > return 0xfff1 if the symbol is in ABS section.
> > > >
> > > > In this case, find_secsym_ndx() will return a absolute symbol as
> > > > base, which won't be relocate, if an ABS symbol is found before the
> > > > real symbol in section 65521.
> > > >
> > >
> > > I see your point here.
> > >
> > > > >
> > > > > > find_secsym_ndx, which use r_info in rela section to find the reference
> >
> > sh_info.
> >
> > > > > > symbol, may take ABS symbol as base.
> > > > > >
> > > > > > Symbol table '.symtab' contains 453285 entries:
> > > > > >    Num:    Value          Size Type    Bind   Vis       Ndx Name
> > > > > >      6: 0000000000000002     0 NOTYPE  LOCAL  DEFAULT   ABS section_count
> > > > > >
> > > > > > Which cause an invalid address in __mcount_loc.
> > > > > >
> > > > >
> > > > > Could you give a better account of the error you are trying to address?
> > > > >
> > > > > Also, arm64 no longer defines a section_count symbol (since v5.11), so
> > > > > please make sure that the diagnostics of the issue you are addressing
> > > > > are accurate for mainline.
> > > > >
> > > >
> > > > My kernel version is 5.4.61.
> > > > But as I explained, I suppose mainline also have this issue.
> > > >
> > >
> > > Mainline is what we work on. So please base your changes (and your
> > > commit log) on mainline.
> > >
> >
> > I understand it.
> > But the platform I can reproduce the problem is only support to 5.4 LTS now.
> > And port it to the latest mainline kernel have much more work to do, can I just
> > keep this commit log? Or just remove the example I posted in the commit messsage?
> >
> > >
> > > > >
> > > > > > Signed-off-by: Mark-PK Tsai <mark-pk.tsai@...iatek.com>
> > > > > > ---
> > > > > >  scripts/recordmcount.h | 4 ++++
> > > > > >  1 file changed, 4 insertions(+)
> > > > > >
> > > > > > diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
> > > > > > index f9b19524da11..9b69167fb7ff 100644
> > > > > > --- a/scripts/recordmcount.h
> > > > > > +++ b/scripts/recordmcount.h
> > > > > > @@ -526,6 +526,10 @@ static int find_secsym_ndx(unsigned const txtndx,
> > > > > >         for (symp = sym0, t = nsym; t; --t, ++symp) {
> > > > > >                 unsigned int const st_bind = ELF_ST_BIND(symp->st_info);
> > > > > >
> > > > > > +               /* avoid absolute symbols */
> > > > > > +               if (symp->st_shndx == SHN_ABS)
> > > > > > +                       continue;
> > > > > > +
> > > > > >                 if (txtndx == get_symindex(symp, symtab, symtab_shndx)
> > > > > >                         /* avoid STB_WEAK */
> > > > > >                     && (STB_LOCAL == st_bind || STB_GLOBAL == st_bind)) {
> >