linux-kernel - Re: objtool "'naked' return found in RETHUNK build" with clang + CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Ys7yBcfBRWXPLsLq@hirez.programming.kicks-ass.net>
Date:   Wed, 13 Jul 2022 18:25:41 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Nathan Chancellor <nathan@...nel.org>
Cc:     Nick Desaulniers <ndesaulniers@...gle.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev
Subject: Re: objtool "'naked' return found in RETHUNK build" with clang +
 CONFIG_K{A,C}SAN=y

On Wed, Jul 13, 2022 at 09:13:29AM -0700, Nathan Chancellor wrote:
> On Wed, Jul 13, 2022 at 09:01:58AM -0700, Nick Desaulniers wrote:
> > On Wed, Jul 13, 2022 at 8:48 AM Nathan Chancellor <nathan@...nel.org> wrote:
> > >
> > > Hi Josh and Peter,
> > >
> > > After commit 9bb2ec608a20 ("objtool: Update Retpoline validation") and
> > > commit f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs"), I
> > > see a spew of objtool warnings when building certain configurations with
> > > clang. Examples below, they appear to trigger in every single file.
> > >
> > > With x86_64_defconfig + CONFIG_KASAN=y:
> > >
> > > arch/x86/ia32/audit.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/ia32/audit.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > init/version.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > init/version.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/fpu/bugs.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/fpu/bugs.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/platform-quirks.o: warning: objtool: asan.module_ctor+0x0: 'naked' return found in RETHUNK build
> > > init/calibrate.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > init/calibrate.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > >
> > > With x86_64_defconfig + CONFIG_KCSAN=y:
> > >
> > > arch/x86/ia32/audit.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > init/calibrate.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > init/version.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/fpu/bugs.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > arch/x86/events/probe.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > arch/x86/kernel/apic/ipi.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > 
> > Thanks for the report. I wonder if this might be a compiler bug; it
> > seems like the {a|t}san.module_{c|d}tor functions are being emitted
> > with ret instructions?
> > 
> > If you have one of these builds lying around still, can you provide:
> > 
> > $ llvm-objdump -dr --disassemble-symbols=tsan.module_ctor
> > arch/x86/kernel/fpu/bugs.o
> 
> Sure thing.
> 
> With KASAN:
> 
> $ llvm-objdump -r --disassemble-symbols=asan.module_ctor,asan.module_dtor build/arch/x86/kernel/fpu/bugs.o
> 
> build/arch/x86/kernel/fpu/bugs.o:	file format elf64-x86-64
> 
> Disassembly of section .text.asan.module_ctor:
> 
> 0000000000000000 <asan.module_ctor>:
>        0: be 01 00 00 00               	movl	$1, %esi
>        5: 48 c7 c7 00 00 00 00         	movq	$0, %rdi
> 		0000000000000008:  R_X86_64_32S	.data
>        c: e8 00 00 00 00               	callq	0x11 <asan.module_ctor+0x11>
> 		000000000000000d:  R_X86_64_PLT32	__asan_register_globals-0x4
>       11: c3                           	retq

As Nick said; this should be: 'jmp __x86_return_thunk', on those builds.