linux-kernel - [PATCH v2] scripts/mksysmap: Ignore prefixed KCFI symbols

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20230626122946.lspu73k24cinwobd@google.com>
Date:   Mon, 26 Jun 2023 12:29:46 +0000
From:   Pierre-Clément Tosi <ptosi@...gle.com>
To:     linux-kbuild@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Masahiro Yamada <masahiroy@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Sami Tolvanen <samitolvanen@...gle.com>
Subject: [PATCH v2] scripts/mksysmap: Ignore prefixed KCFI symbols

The (relatively) new KCFI feature in LLVM/Clang encodes type information
for C functions by generating symbols named __kcfi_typeid_<fname>, which
can then be referenced from assembly. However, some custom build rules
(e.g. nVHE or early PIE on arm64) use objcopy to add a prefix to all the
symbols in their object files, making mksysmap's ignore filter miss
those KCFI symbols.

Therefore, explicitly list those twice-prefixed KCFI symbols as ignored.

Alternatively, this could also be achieved in a less verbose way by
ignoring any symbol containing the string "__kcfi_typeid_". However,
listing the combined prefixes explicitly saves us from running the small
risk of ignoring symbols that should be kept.

Signed-off-by: Pierre-Clément Tosi <ptosi@...gle.com>
---
Changes in v2:
    Removed redundant filter for EFI KCFI symbol names.

 scripts/mksysmap | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/scripts/mksysmap b/scripts/mksysmap
index 26f39772f7a5..9ba1c9da0a40 100755
--- a/scripts/mksysmap
+++ b/scripts/mksysmap
@@ -62,6 +62,8 @@ ${NM} -n ${1} | sed >${2} -e "

 # CFI type identifiers
 / __kcfi_typeid_/d
+/ __kvm_nvhe___kcfi_typeid_/d
+/ __pi___kcfi_typeid_/d

 # CRC from modversions
 / __crc_/d
-- 
2.41.0.162.gfafddb0af9-goog

-- 
Pierre