linux-kernel - Re: [PATCH 10/18] objtool: Extricate ibt from stack validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <YlhvpGsUFIOLByhp@hirez.programming.kicks-ass.net>
Date:   Thu, 14 Apr 2022 21:01:56 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Josh Poimboeuf <jpoimboe@...hat.com>
Cc:     x86@...nel.org, linux-kernel@...r.kernel.org,
        Miroslav Benes <mbenes@...e.cz>
Subject: Re: [PATCH 10/18] objtool: Extricate ibt from stack validation

On Thu, Apr 14, 2022 at 11:25:05AM -0700, Josh Poimboeuf wrote:
> On Thu, Apr 14, 2022 at 10:05:53AM -0700, Josh Poimboeuf wrote:
> > On Thu, Apr 14, 2022 at 06:38:16PM +0200, Peter Zijlstra wrote:
> > > On Thu, Apr 14, 2022 at 08:44:49AM -0700, Josh Poimboeuf wrote:
> > > 
> > > > Ok.  That was subtle, it needs a comment or two.  I had the distinct
> > > > feeling I was introducing a bug, then I got distracted ;-)
> > > 
> > > Right, lemme try and not forget to write one ;-)
> > 
> > I'm rewriting the code anyway, I'll add some comments.
> > 
> > > > Doesn't the compiler give those special cases ENDBR anyway?  Just
> > > > wondering why we avoid the warning for those.
> > > 
> > > Sure, but this is about not scribbling that ENDBR with a NOP.
> > 
> > Right, but it only prints warnings for data sections, despite marking
> > others:
> > 
> > -                       dest = validate_ibt_reloc(file, reloc);
> > -                       if (is_data && dest && !dest->noendbr)
> > -                               warn_noendbr("data ", sec, reloc->offset, dest);
> 
> 
> How about this?  This way it doesn't silence warnings for non
> .data/.rodata, as other sections (including ksymtab) can also have valid
> function pointers.  It also caught a bug(?) in putuser.S, as some of the
> exported inner labels didn't have ENDBR.
> 
> 
> diff --git a/arch/x86/include/asm/static_call.h b/arch/x86/include/asm/static_call.h
> index 2455d721503e..2d8dacd02643 100644
> --- a/arch/x86/include/asm/static_call.h
> +++ b/arch/x86/include/asm/static_call.h
> @@ -26,6 +26,7 @@
>  	    ".align 4						\n"	\
>  	    ".globl " STATIC_CALL_TRAMP_STR(name) "		\n"	\
>  	    STATIC_CALL_TRAMP_STR(name) ":			\n"	\
> +	    ANNOTATE_NOENDBR						\
>  	    insns "						\n"	\
>  	    ".byte 0x53, 0x43, 0x54				\n"	\
>  	    ".type " STATIC_CALL_TRAMP_STR(name) ", @function	\n"	\

Right, that makes more sense than hard-coding that exclusion, no idea
what I was thinking ;-)

> diff --git a/arch/x86/lib/putuser.S b/arch/x86/lib/putuser.S
> index ecb2049c1273..b7dfd60243b7 100644
> --- a/arch/x86/lib/putuser.S
> +++ b/arch/x86/lib/putuser.S
> @@ -48,6 +48,7 @@ SYM_FUNC_START(__put_user_1)
>  	cmp %_ASM_BX,%_ASM_CX
>  	jae .Lbad_put_user
>  SYM_INNER_LABEL(__put_user_nocheck_1, SYM_L_GLOBAL)
> +	ENDBR
>  	ASM_STAC
>  1:	movb %al,(%_ASM_CX)
>  	xor %ecx,%ecx
> @@ -62,6 +63,7 @@ SYM_FUNC_START(__put_user_2)
>  	cmp %_ASM_BX,%_ASM_CX
>  	jae .Lbad_put_user
>  SYM_INNER_LABEL(__put_user_nocheck_2, SYM_L_GLOBAL)
> +	ENDBR
>  	ASM_STAC
>  2:	movw %ax,(%_ASM_CX)
>  	xor %ecx,%ecx
> @@ -76,6 +78,7 @@ SYM_FUNC_START(__put_user_4)
>  	cmp %_ASM_BX,%_ASM_CX
>  	jae .Lbad_put_user
>  SYM_INNER_LABEL(__put_user_nocheck_4, SYM_L_GLOBAL)
> +	ENDBR
>  	ASM_STAC
>  3:	movl %eax,(%_ASM_CX)
>  	xor %ecx,%ecx
> @@ -90,6 +93,7 @@ SYM_FUNC_START(__put_user_8)
>  	cmp %_ASM_BX,%_ASM_CX
>  	jae .Lbad_put_user
>  SYM_INNER_LABEL(__put_user_nocheck_8, SYM_L_GLOBAL)
> +	ENDBR
>  	ASM_STAC
>  4:	mov %_ASM_AX,(%_ASM_CX)
>  #ifdef CONFIG_X86_32

Hmm, how did those go missing?

> diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S
> index 5f87bab4fb8d..b2b2366885a2 100644
> --- a/arch/x86/lib/retpoline.S
> +++ b/arch/x86/lib/retpoline.S
> @@ -31,6 +31,7 @@
>  	.align RETPOLINE_THUNK_SIZE
>  SYM_INNER_LABEL(__x86_indirect_thunk_\reg, SYM_L_GLOBAL)
>  	UNWIND_HINT_EMPTY
> +	ANNOTATE_NOENDBR
>  
>  	ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *%\reg), \
>  		      __stringify(RETPOLINE \reg), X86_FEATURE_RETPOLINE, \
> @@ -55,7 +56,6 @@ SYM_INNER_LABEL(__x86_indirect_thunk_\reg, SYM_L_GLOBAL)
>  
>  	.align RETPOLINE_THUNK_SIZE
>  SYM_CODE_START(__x86_indirect_thunk_array)
> -	ANNOTATE_NOENDBR // apply_retpolines
>  
>  #define GEN(reg) THUNK reg
>  #include <asm/GEN-for-each-reg.h>

Hmm, where does that come from? Do you have commit be8a096521ca
("x86,bpf: Avoid IBT objtool warning")?

> diff --git a/arch/x86/xen/xen-head.S b/arch/x86/xen/xen-head.S
> index ac17196e2518..3a2cd93bf059 100644
> --- a/arch/x86/xen/xen-head.S
> +++ b/arch/x86/xen/xen-head.S
> @@ -45,6 +45,7 @@ SYM_CODE_END(hypercall_page)
>  	__INIT
>  SYM_CODE_START(startup_xen)
>  	UNWIND_HINT_EMPTY
> +	ANNOTATE_NOENDBR
>  	cld
>  
>  	/* Clear .bss */
> diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> index b09c416432b6..10e375c84088 100644
> --- a/tools/objtool/check.c
> +++ b/tools/objtool/check.c
> @@ -3794,7 +3794,10 @@ static int validate_ibt_data_reloc(struct objtool_file *file,
>  	return 1;
>  }
>  
> -
> +/*
> + * Validate IBT rules and mark used ENDBR instructions so the non-used ones can
> + * be sealed later by create_ibt_endbr_seal_sections().
> + */
>  static int validate_ibt(struct objtool_file *file)
>  {
>  	struct section *sec;
> @@ -3807,12 +3810,36 @@ static int validate_ibt(struct objtool_file *file)
>  
>  	for_each_sec(file, sec) {
>  
> -		if (!strstr(sec->name, ".data") && !strstr(sec->name, ".rodata"))
> +		/* Already done by validate_ibt_insn() */
> +		if (sec->sh.sh_flags & SHF_EXECINSTR)
>  			continue;
>  
>  		if (!sec->reloc)
>  			continue;
>  
> +		/*
> +		 * These sections can reference text addresses, but not with
> +		 * the intent to indirect branch to them.
> +		 */
> +		if (!strncmp(sec->name, ".discard", 8)			||
> +		    !strncmp(sec->name, ".debug", 6)			||
> +		    !strcmp(sec->name, ".altinstructions")		||
> +		    !strcmp(sec->name, ".ibt_endbr_seal")		||
> +		    !strcmp(sec->name, ".orc_unwind_ip")		||
> +		    !strcmp(sec->name, ".parainstructions")		||
> +		    !strcmp(sec->name, ".retpoline_sites")		||
> +		    !strcmp(sec->name, ".smp_locks")			||
> +		    !strcmp(sec->name, ".static_call_sites")		||
> +		    !strcmp(sec->name, ".static_call_tramp_key")	||
> +		    !strcmp(sec->name, "_error_injection_whitelist")	||
> +		    !strcmp(sec->name, "_kprobe_blacklist")		||
> +		    !strcmp(sec->name, "__bug_table")			||
> +		    !strcmp(sec->name, "__ex_table")			||
> +		    !strcmp(sec->name, "__jump_table")			||
> +		    !strcmp(sec->name, "__mcount_loc")			||
> +		    !strcmp(sec->name, "__tracepoints"))
> +			continue;
> +
>  		list_for_each_entry(reloc, &sec->reloc->reloc_list, list)
>  			warnings += validate_ibt_data_reloc(file, reloc);
>  	}
> 

Yes, looks good, Thanks!