linux-kernel - Re: [PATCH 2/2] powerpc/module_64: Fix "expected nop" error on module re-patching

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230125185316.ebvxecd7gsvgtudr@treble>
Date:   Wed, 25 Jan 2023 10:53:16 -0800
From:   Josh Poimboeuf <jpoimboe@...nel.org>
To:     Song Liu <song@...nel.org>
Cc:     live-patching@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        linux-kernel@...r.kernel.org, Nicholas Piggin <npiggin@...il.com>
Subject: Re: [PATCH 2/2] powerpc/module_64: Fix "expected nop" error on
 module re-patching

On Wed, Jan 25, 2023 at 09:36:02AM -0800, Song Liu wrote:
> On Wed, Jan 25, 2023 at 8:46 AM Josh Poimboeuf <jpoimboe@...nel.org> wrote:
> >
> > On Tue, Jan 24, 2023 at 10:09:56PM -0800, Song Liu wrote:
> > > > @@ -514,9 +515,18 @@ static int restore_r2(const char *name, u32 *instruction, struct module *me)
> > > >         if (!instr_is_relative_link_branch(ppc_inst(*prev_insn)))
> > > >                 return 0;
> > > >
> > > > -       if (*instruction != PPC_RAW_NOP()) {
> > > > +       /*
> > > > +        * For livepatch, the restore r2 instruction might have already been
> > > > +        * written previously, if the referenced symbol is in a previously
> > > > +        * unloaded module which is now being loaded again.  In that case, skip
> > > > +        * the warning and the instruction write.
> > > > +        */
> > > > +       if (insn_val == PPC_INST_LD_TOC)
> > > > +               return 0;
> > >
> > > Do we need "sym->st_shndx == SHN_LIVEPATCH" here?
> >
> > My original patch had that check, but I dropped it for simplicity.
> >
> > In the non-livepatch case, the condition should never be true, but it
> > doesn't hurt to check it anyway.
> 
> While this is the only place we use PPC_INST_LD_TOC, there is another
> place we use "PPC_RAW_STD(_R2, _R1, R2_STACK_OFFSET)", which
> is identical to PPC_INST_LD_TOC. So I am not quite sure whether this
> happens for non-livepatch.

It's not actually identical.  That's the "store r2 to the stack"
counterpart to the load in PPC_INST_LD_TOC, which loads r2 from the
stack.

For R_PPC_REL24 relocations, when calling a function which lives outside
the module, 24 bits isn't enough to encode the relative branch target
address.  So it has to save r2 (TOC pointer) to the stack, and branch to
a stub, which then branches to the external function.

When the external function returns execution to the instruction after
the original branch, that instruction needs to restore the TOC pointer
from the stack to r2.

The compiler knows this, and emits the instruction after the branch as a
NOP.  The module code replaces that NOP with a "restore r2 from the
stack".  That's what restore_r2() does.

Long story short, restore_r2() needs to ensure the instruction after the
branch restores r2 from the stack.  If that instruction is already
there, it doesn't need to do anything.

-- 
Josh