linux-kernel - Re: [PATCH 4/9] x86/alternative: Implement .retpoline

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 19 Oct 2021 12:16:11 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Alexander Lobakin <alobakin@...me>
Cc:     Borislav Petkov <bp@...en8.de>, x86@...nel.org,
        jpoimboe@...hat.com, andrew.cooper3@...rix.com,
        linux-kernel@...r.kernel.org, alexei.starovoitov@...il.com,
        ndesaulniers@...gle.com, samitolvanen@...gle.com
Subject: Re: [PATCH 4/9] x86/alternative: Implement .retpoline_sites support

+ Sami

(Sami, for context:

  https://git.kernel.org/pub/scm/linux/kernel/git/peterz/queue.git/log/?h=objtool/core

which contains the following code:

+	void (*target)(void);
+	int reg, i = 0;
+
+	target = addr + insn->length + insn->immediate.value;
+	reg = (target - &__x86_indirect_thunk_rax) /
+	      (&__x86_indirect_thunk_rcx - &__x86_indirect_thunk_rax);
+
+	if (WARN_ON_ONCE(reg & ~0xf))
+		return -1;

which blows up something fierce on clang-cfi)

On Tue, Oct 19, 2021 at 09:47:26AM +0000, Alexander Lobakin wrote:

> Oh okay, it's because of ClangCFI:
> 
> SMP alternatives: You were looking for __typeid__ZTSFvvE_global_addr+0x370/0x1410 at 0xffffffffa523cd60,>
> SMP alternatives: rax is __typeid__ZTSFvvE_global_addr+0x360/0x1410 at 0xffffffffa523cd50
> 
> Sorry for confusing, seems like it's a side effect of using it on
> Clang 12 while the original series supports only 13+. I'll double
> check and let know if find something.

I'm thinking CFI will totally screw this up regardless, seeing how a
function pointer is taken, and the CFI magicks will turn that into one
of those weird trampolines instead of the actual symbol.

The compiler could of course deduce that these addresses are never
called and don't escape the function, and therefore doesn't need to do
the CFI transformation on then, but I'm guessing it isn't quite that
clever.

Also doing CFI on retpoline thunks seems 'weird', they have a very
particular calling convention, excplicitly very much not the standard C
one. Can't we mark them using asmlinkage or something to tell the
compiler to politely 'bugger off' or somesuch ;-)