linux-kernel - Re: objtool "'naked' return found in RETHUNK build" with clang + CONFIG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKwvOdmcU3SxgMGsX4MRfR6mskYu5kPYNwUNuNLKeSeskMV5Qg@mail.gmail.com>
Date:   Wed, 13 Jul 2022 09:42:16 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Nathan Chancellor <nathan@...nel.org>
Cc:     Josh Poimboeuf <jpoimboe@...nel.org>, linux-kernel@...r.kernel.org,
        llvm@...ts.linux.dev, Peter Zijlstra <peterz@...radead.org>
Subject: Re: objtool "'naked' return found in RETHUNK build" with clang + CONFIG_K{A,C}SAN=y

On Wed, Jul 13, 2022 at 9:25 AM Peter Zijlstra <peterz@...radead.org> wrote:
>
> On Wed, Jul 13, 2022 at 09:13:29AM -0700, Nathan Chancellor wrote:
> > On Wed, Jul 13, 2022 at 09:01:58AM -0700, Nick Desaulniers wrote:
> > > On Wed, Jul 13, 2022 at 8:48 AM Nathan Chancellor <nathan@...nel.org> wrote:
> > > >
> > > > Hi Josh and Peter,
> > > >
> > > > After commit 9bb2ec608a20 ("objtool: Update Retpoline validation") and
> > > > commit f43b9876e857 ("x86/retbleed: Add fine grained Kconfig knobs"), I
> > > > see a spew of objtool warnings when building certain configurations with
> > > > clang. Examples below, they appear to trigger in every single file.
> > > >
> > > > With x86_64_defconfig + CONFIG_KASAN=y:
> > > >
> > > > arch/x86/ia32/audit.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/ia32/audit.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > > init/version.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > > init/version.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/fpu/bugs.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/fpu/bugs.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/platform-quirks.o: warning: objtool: asan.module_ctor+0x0: 'naked' return found in RETHUNK build
> > > > init/calibrate.o: warning: objtool: asan.module_ctor+0x11: 'naked' return found in RETHUNK build
> > > > init/calibrate.o: warning: objtool: asan.module_dtor+0x11: 'naked' return found in RETHUNK build
> > > >
> > > > With x86_64_defconfig + CONFIG_KCSAN=y:
> > > >
> > > > arch/x86/ia32/audit.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > init/calibrate.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > init/version.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/fpu/bugs.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/cpu/rdrand.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > arch/x86/events/probe.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > > > arch/x86/kernel/apic/ipi.o: warning: objtool: tsan.module_ctor+0x5: 'naked' return found in RETHUNK build
> > >
> > > Thanks for the report. I wonder if this might be a compiler bug; it
> > > seems like the {a|t}san.module_{c|d}tor functions are being emitted
> > > with ret instructions?
> > >
> > > If you have one of these builds lying around still, can you provide:
> > >
> > > $ llvm-objdump -dr --disassemble-symbols=tsan.module_ctor
> > > arch/x86/kernel/fpu/bugs.o
> >
> > Sure thing.
> >
> > With KASAN:
> >
> > $ llvm-objdump -r --disassemble-symbols=asan.module_ctor,asan.module_dtor build/arch/x86/kernel/fpu/bugs.o
> >
> > build/arch/x86/kernel/fpu/bugs.o:     file format elf64-x86-64
> >
> > Disassembly of section .text.asan.module_ctor:
> >
> > 0000000000000000 <asan.module_ctor>:
> >        0: be 01 00 00 00                      movl    $1, %esi
> >        5: 48 c7 c7 00 00 00 00                movq    $0, %rdi
> >               0000000000000008:  R_X86_64_32S .data
> >        c: e8 00 00 00 00                      callq   0x11 <asan.module_ctor+0x11>
> >               000000000000000d:  R_X86_64_PLT32       __asan_register_globals-0x4
> >       11: c3                                  retq
>
> As Nick said; this should be: 'jmp __x86_return_thunk', on those builds.

https://github.com/llvm/llvm-project/issues/56514

-- 
Thanks,
~Nick Desaulniers