linux-kernel - Re: [PATCH] LoongArch: Disable module from accessing external data directly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d32d8a26dcd75a840727cdb50546b621d34d326b.camel@xry111.site>
Date:   Wed, 08 Nov 2023 16:30:05 +0800
From:   Xi Ruoyao <xry111@...111.site>
To:     WANG Rui <wangrui@...ngson.cn>, Huacai Chen <chenhuacai@...nel.org>
Cc:     WANG Xuerui <kernel@...0n.name>, linux-kernel@...r.kernel.org,
        loongarch@...ts.linux.dev, linux-kbuild@...r.kernel.org,
        llvm@...ts.linux.dev, loongson-kernel@...ts.loongnix.cn,
        Fangrui Song <maskray@...gle.com>
Subject: Re: [PATCH] LoongArch: Disable module from accessing external data
 directly

On Wed, 2023-11-08 at 12:04 +0800, WANG Rui wrote:
> When compiling module with GCC, the option `-mdirect-extern-access` is
> disabled by default. The Clang option `-fdirect-access-external-data`
> is enabled by default, so it needs to be explicitly disabled.

I'm wondering why it's enabled by default.

For this simple test case:

extern char **environ;

int main()
{
  __builtin_printf("%10s\n", environ[0]);
}

With Clang 17.0.4 and "clang t1.c -S -O2", it compiles to:

main:
	addi.d	$sp, $sp, -16
	st.d	$ra, $sp, 8
	pcalau12i	$a0, %got_pc_hi20(environ)
	ld.d	$a0, $a0, %got_pc_lo12(environ)
	ld.d	$a0, $a0, 0
	ld.d	$a1, $a0, 0
	pcalau12i	$a0, %pc_hi20(.L.str)
	addi.d	$a0, $a0, %pc_lo12(.L.str)
	bl	%plt(printf)
	move	$a0, $zero
	ld.d	$ra, $sp, 8
	addi.d	$sp, $sp, 16
	ret

So GOT is used for accessing the external variable environ.  With "clang
t1.c -S -O2 -fdirect-access-external-data", we get:

main:
	addi.d	$sp, $sp, -16
	st.d	$ra, $sp, 8
	pcalau12i	$a0, %pc_hi20(environ)
	addi.d	$a0, $a0, %pc_lo12(environ)
	ld.d	$a0, $a0, 0
	ld.d	$a1, $a0, 0
	pcalau12i	$a0, %pc_hi20(.L.str)
	addi.d	$a0, $a0, %pc_lo12(.L.str)
	bl	%plt(printf)
	move	$a0, $zero
	ld.d	$ra, $sp, 8
	addi.d	$sp, $sp, 16
	ret

then the linked binary triggers a SIGBUS.  Ideally this should be
detected by the linker at link time, but currently the BFD linker fails
to detect this error (FWIW this flaw is caused by a really nasty method
for the medium code model implementation).  So to me -fno-direct-access-
external-data is the default.  I also grepped for -fdirect-access-
external-data in the kernel building system but I've not found any
match. 

Are you using a different version of Clang, or maybe Clang has some
configuration-time option to make -fdirect-access-external-data the
default?

Note that to translate a TU for a normal (dynamically-linked user-space)
executable on LoongArch Linux, -fdirect-access-external-data should not
be used (because copy relocation is now considered a bad idea and we'll
not support it for a new architecture).  Fangrui?

-fdirect-access-external-data can be used in KBUILD_CFLAGS_KERNEL for
avoiding GOT in the main kernel image, OTOH.

-- 
Xi Ruoyao <xry111@...111.site>
School of Aerospace Science and Technology, Xidian University