linux-kernel - Re: [patch 00/38] x86/retbleed: Call depth tracking mitigation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20220720143147.4d8a2f8d@gandalf.local.home>
Date:   Wed, 20 Jul 2022 14:31:47 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        LKML <linux-kernel@...r.kernel.org>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        Tim Chen <tim.c.chen@...ux.intel.com>,
        Josh Poimboeuf <jpoimboe@...nel.org>,
        Andrew Cooper <Andrew.Cooper3@...rix.com>,
        Pawan Gupta <pawan.kumar.gupta@...ux.intel.com>,
        Johannes Wikner <kwikner@...z.ch>,
        Alyssa Milburn <alyssa.milburn@...ux.intel.com>,
        Jann Horn <jannh@...gle.com>, "H.J. Lu" <hjl.tools@...il.com>,
        Joao Moreira <joao.moreira@...el.com>,
        Joseph Nuzman <joseph.nuzman@...el.com>,
        Juergen Gross <jgross@...e.com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>
Subject: Re: [patch 00/38] x86/retbleed: Call depth tracking mitigation

On Wed, 20 Jul 2022 11:07:26 -0700
Linus Torvalds <torvalds@...ux-foundation.org> wrote:

> On Wed, Jul 20, 2022 at 10:50 AM Steven Rostedt <rostedt@...dmis.org> wrote:
> >
> > [    2.464117] missing return thunk: lkdtm_rodata_do_nothing+0x0/0x8-lkdtm_rodata_do_nothing+0x5/0x8: e9 00 00 00 00  
> 
> Well, that looks like a "jmp" instruction that has never been relocated.
> 
> The 'e9' is 'jmp', the four zeros after it are either "I'm jumping to
> the next instruction" or "I haven't been filled in".
> 
> I'm assuming it's the second case.
> 
> That lkdtm_rodata_do_nothing thing is odd, and does
> 
>     OBJCOPYFLAGS_rodata_objcopy.o   := \
>                             --rename-section
> .noinstr.text=.rodata,alloc,readonly,load,contents
> 
> to put the code in an odd section. I'm assuming this hackery is
> related to it then not getting relocated.
> 

Right, because this looks to be some magic being done for testing purposes:

static void lkdtm_EXEC_RODATA(void)
{
        execute_location(dereference_function_descriptor(lkdtm_rodata_do_nothing),
                         CODE_AS_IS);
}

static void *setup_function_descriptor(func_desc_t *fdesc, void *dst)
{
        if (!have_function_descriptors())
                return dst;

        memcpy(fdesc, do_nothing, sizeof(*fdesc));
        fdesc->addr = (unsigned long)dst;
        barrier();

        return fdesc;
}

static noinline void execute_location(void *dst, bool write)
{
        void (*func)(void);
        func_desc_t fdesc;
        void *do_nothing_text = dereference_function_descriptor(do_nothing);

        pr_info("attempting ok execution at %px\n", do_nothing_text);
        do_nothing();

        if (write == CODE_WRITE) {
                memcpy(dst, do_nothing_text, EXEC_SIZE);
                flush_icache_range((unsigned long)dst,
                                   (unsigned long)dst + EXEC_SIZE);
        }
        pr_info("attempting bad execution at %px\n", dst);
        func = setup_function_descriptor(&fdesc, dst);
        func();
        pr_err("FAIL: func returned\n");
}

And that appears that it wants to crash, as the code is located in readonly
data.

OBJCOPYFLAGS_rodata_objcopy.o   := \
                        --rename-section .noinstr.text=.rodata,alloc,readonly,load,contents

And because the alternatives fixup tries to write to it, and fails due to
it being readonly, I'm guessing we get this warning.

Thus, is there a way to keep this file from being entered into the
return_sites section?

-- Steve