linux-kernel - Re: [PATCH] LoongArch: Disable module from accessing external data directly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHirt9jQHTRGdv4rShgvWHEbG1vzuLkNDbxLP7x4eMtuB3BB5g@mail.gmail.com>
Date:   Wed, 8 Nov 2023 17:20:48 +0800
From:   WANG Rui <wangrui@...ngson.cn>
To:     Xi Ruoyao <xry111@...111.site>
Cc:     Huacai Chen <chenhuacai@...nel.org>,
        WANG Xuerui <kernel@...0n.name>, linux-kernel@...r.kernel.org,
        loongarch@...ts.linux.dev, linux-kbuild@...r.kernel.org,
        llvm@...ts.linux.dev, loongson-kernel@...ts.loongnix.cn,
        Fangrui Song <maskray@...gle.com>
Subject: Re: [PATCH] LoongArch: Disable module from accessing external data directly

On Wed, Nov 8, 2023 at 4:37 PM Xi Ruoyao <xry111@...111.site> wrote:
>
> On Wed, 2023-11-08 at 12:04 +0800, WANG Rui wrote:
> > When compiling module with GCC, the option `-mdirect-extern-access` is
> > disabled by default. The Clang option `-fdirect-access-external-data`
> > is enabled by default, so it needs to be explicitly disabled.
>
> I'm wondering why it's enabled by default.
>
> For this simple test case:
>
> extern char **environ;
>
> int main()
> {
>   __builtin_printf("%10s\n", environ[0]);
> }
>
> With Clang 17.0.4 and "clang t1.c -S -O2", it compiles to:
>
> main:
>         addi.d  $sp, $sp, -16
>         st.d    $ra, $sp, 8
>         pcalau12i       $a0, %got_pc_hi20(environ)
>         ld.d    $a0, $a0, %got_pc_lo12(environ)
>         ld.d    $a0, $a0, 0
>         ld.d    $a1, $a0, 0
>         pcalau12i       $a0, %pc_hi20(.L.str)
>         addi.d  $a0, $a0, %pc_lo12(.L.str)
>         bl      %plt(printf)
>         move    $a0, $zero
>         ld.d    $ra, $sp, 8
>         addi.d  $sp, $sp, 16
>         ret
>
> So GOT is used for accessing the external variable environ.  With "clang
> t1.c -S -O2 -fdirect-access-external-data", we get:
>
> main:
>         addi.d  $sp, $sp, -16
>         st.d    $ra, $sp, 8
>         pcalau12i       $a0, %pc_hi20(environ)
>         addi.d  $a0, $a0, %pc_lo12(environ)
>         ld.d    $a0, $a0, 0
>         ld.d    $a1, $a0, 0
>         pcalau12i       $a0, %pc_hi20(.L.str)
>         addi.d  $a0, $a0, %pc_lo12(.L.str)
>         bl      %plt(printf)
>         move    $a0, $zero
>         ld.d    $ra, $sp, 8
>         addi.d  $sp, $sp, 16
>         ret
>
> then the linked binary triggers a SIGBUS.  Ideally this should be
> detected by the linker at link time, but currently the BFD linker fails
> to detect this error (FWIW this flaw is caused by a really nasty method
> for the medium code model implementation).  So to me -fno-direct-access-
> external-data is the default.  I also grepped for -fdirect-access-
> external-data in the kernel building system but I've not found any
> match.
>
> Are you using a different version of Clang, or maybe Clang has some
> configuration-time option to make -fdirect-access-external-data the
> default?

The clang enables `direct-access-external-data` by default in PIC and
disables it by default in no-PIC. This also applies to PIE. [1]

I found that clang PIE in different default states for different
environments. For instance, cross-compile is off, while native-compile
is on.

>
> Note that to translate a TU for a normal (dynamically-linked user-space)
> executable on LoongArch Linux, -fdirect-access-external-data should not
> be used (because copy relocation is now considered a bad idea and we'll
> not support it for a new architecture).  Fangrui?
>
> -fdirect-access-external-data can be used in KBUILD_CFLAGS_KERNEL for
> avoiding GOT in the main kernel image, OTOH.

I also saw that compiling vmlinux already includes the `-fno-PIE`
option, which for clang is `direct-access-external-data` enabled.

>
> --
> Xi Ruoyao <xry111@...111.site>
> School of Aerospace Science and Technology, Xidian University
>

[1] https://github.com/llvm/llvm-project/blob/llvmorg-17.0.4/clang/lib/Frontend/CompilerInvocation.cpp#L1654-L1659

-- 
WANG Rui