linux-kernel - Re: [PATCH] kallsyms: strip LTO-only suffixes from promoted global functions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <7404b9cd-f57e-e76b-87ff-ae3b1f68e381@meta.com>
Date:   Wed, 28 Jun 2023 10:25:55 -0700
From:   Yonghong Song <yhs@...a.com>
To:     "Leizhen (ThunderTown)" <thunder.leizhen@...wei.com>,
        Yonghong Song <yhs@...com>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Petr Mladek <pmladek@...e.com>, Song Liu <song@...nel.org>
Cc:     Fangrui Song <maskray@...gle.com>, kernel-team@...com,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev
Subject: Re: [PATCH] kallsyms: strip LTO-only suffixes from promoted global
 functions



On 6/28/23 4:34 AM, Leizhen (ThunderTown) wrote:
> 
> 
> On 2023/6/28 14:44, Yonghong Song wrote:
>> Commit 6eb4bd92c1ce ("kallsyms: strip LTO suffixes from static functions")
>> stripped all function/variable suffixes started with '.' regardless
>> of whether those suffixes are generated at LTO mode or not. In fact,
>> as far as I know, in LTO mode, when a static function/variable is
>> promoted to the global scope, '.llvm.<...>' suffix is added.
>>
>> The existing mechanism breaks live patch for a LTO kernel even if
>> no <symbol>.llvm.<...> symbols are involved. For example, for the following
>> kernel symbols:
>>    $ grep bpf_verifier_vlog /proc/kallsyms
>>    ffffffff81549f60 t bpf_verifier_vlog
>>    ffffffff8268b430 d bpf_verifier_vlog._entry
>>    ffffffff8282a958 d bpf_verifier_vlog._entry_ptr
>>    ffffffff82e12a1f d bpf_verifier_vlog.__already_done
>> 'bpf_verifier_vlog' is a static function. '_entry', '_entry_ptr' and
>> '__already_done' are static variables used inside 'bpf_verifier_vlog',
>> so llvm promotes them to file-level static with prefix 'bpf_verifier_vlog.'.
>> Note that the func-level to file-level static function promotion also
>> happens without LTO.
>>
>> Given a symbol name 'bpf_verifier_vlog', with LTO kernel, current mechanism will
>> return 4 symbols to live patch subsystem which current live patching
>> subsystem cannot handle it. With non-LTO kernel, only one symbol
>> is returned.
>>
>> In [1], we have a lengthy discussion, the suggestion is to separate two
>> cases:
>>    (1). new symbols with suffix which are generated regardless of whether
>>         LTO is enabled or not, and
>>    (2). new symbols with suffix generated only when LTO is enabled.
>>
>> The cleanup_symbol_name() should only remove suffixes for case (2).
>> Case (1) should not be changed so it can work uniformly with or without LTO.
>>
>> This patch removed LTO-only suffix '.llvm.<...>' so live patching and
>> tracing should work the same way for non-LTO kernel.
>>
>>   [1] https://lore.kernel.org/live-patching/20230615170048.2382735-1-song@kernel.org/T/#u
> 
> Missed the addition of:
> Reported-by: Song Liu <song@...nel.org>

Will add in the next revision.

> 
>>
>> Fixes: 6eb4bd92c1ce ("kallsyms: strip LTO suffixes from static functions")
>> Signed-off-by: Yonghong Song <yhs@...com>
>> ---
>>   kernel/kallsyms.c | 5 ++---
>>   1 file changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
>> index 77747391f49b..4874508bb950 100644
>> --- a/kernel/kallsyms.c
>> +++ b/kernel/kallsyms.c
>> @@ -174,11 +174,10 @@ static bool cleanup_symbol_name(char *s)
>>   	 * LLVM appends various suffixes for local functions and variables that
>>   	 * must be promoted to global scope as part of LTO.  This can break
>>   	 * hooking of static functions with kprobes. '.' is not a valid
>> -	 * character in an identifier in C. Suffixes observed:
>> +	 * character in an identifier in C. Suffixes only in LLVM LTO observed:
>>   	 * - foo.llvm.[0-9a-f]+
>> -	 * - foo.[0-9a-f]+
>>   	 */
>> -	res = strchr(s, '.');
>> +	res = strstr(s, ".llvm.");
> 
> We'd better modify function cleanup_symbol_name() in scripts/kallsyms.c accordingly.

Thanks, will make corresponding change in scripts/kallsyms.c as well.

> 
> 
>>   	if (res) {
>>   		*res = '\0';
>>   		return true;
>>
>