linux-kernel - Re: WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x566 (section: .text) -> poison

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 15 Apr 2024 11:14:34 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Kees Cook <keescook@...omium.org>
Cc: Peter Zijlstra <peterz@...radead.org>,
	kernel test robot <lkp@...el.com>, llvm@...ts.linux.dev,
	oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
	Sami Tolvanen <samitolvanen@...gle.com>
Subject: Re: WARNING: modpost: vmlinux: section mismatch in reference:
 __apply_fineibt+0x566 (section: .text) -> poison_endbr (section: .init.text)

On Mon, Apr 15, 2024 at 10:14:03AM -0700, Kees Cook wrote:
> On Mon, Apr 15, 2024 at 10:15:48AM +0800, kernel test robot wrote:
> > Hi Peter,
> > 
> > FYI, the error/warning still remains.
> > 
> > tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > head:   0bbac3facb5d6cc0171c45c9873a2dc96bea9680
> > commit: 04505bbbbb15da950ea0239e328a76a3ad2376e0 x86/fineibt: Poison ENDBR at +0
> > date:   9 months ago
> > config: x86_64-buildonly-randconfig-001-20240415 (https://download.01.org/0day-ci/archive/20240415/202404151042.vATlNGmU-lkp@intel.com/config)
> > compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240415/202404151042.vATlNGmU-lkp@intel.com/reproduce)
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@...el.com>
> > | Closes: https://lore.kernel.org/oe-kbuild-all/202404151042.vATlNGmU-lkp@intel.com/
> > 
> > All warnings (new ones prefixed by >>, old ones prefixed by <<):
> > 
> > WARNING: modpost: missing MODULE_DESCRIPTION() in vmlinux.o
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x12e (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x1f2 (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x2e6 (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x381 (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x3a4 (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x44d (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x50d (section: .text) -> text_poke_early (section: .init.text)
> > WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x532 (section: .text) -> text_poke_early (section: .init.text)
> > >> WARNING: modpost: vmlinux: section mismatch in reference: __apply_fineibt+0x566 (section: .text) -> poison_endbr (section: .init.text)
> 
> test_poke_early() already marked __init_or_module, so shouldn't these
> warnings not happen? (I assume the same is for true poison_endbr)

Hmmm, how so? __init_or_module is __init when CONFIG_MODULES is not set
(which is true for this configuration), which means text_poke_early() is
__init while __apply_fineibt() is not.

$ curl -LSs https://download.01.org/0day-ci/archive/20240415/202404151042.vATlNGmU-lkp@intel.com/config | rg CONFIG_MODULES
CONFIG_MODULES_USE_ELF_RELA=y
# CONFIG_MODULES is not set

Looking further into it though, I think that marking apply_fineibt() and
__apply_fineibt() as __init_or_module as well would resolve this?

__apply_fineibt() is called from two places: alternative_instructions()
(which is __init) and apply_fineibt(). Looking at apply_fineibt(), it is
only called from module_finalize() in arch/x86/kernel/module.c, which is
only included when CONFIG_MODULES=y. As a result, __apply_fineibt() is
only ever called from __init code when CONFIG_MODULES is not set but it
is called from module code so it should not be discarded with
CONFIG_MODULES=y, as it currently is.

In other words, the following diff works for me.

Cheers,
Nathan

diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 45a280f2161c..1f6a29048a95 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -1262,8 +1262,9 @@ static int cfi_rewrite_callers(s32 *start, s32 *end)
 	return 0;
 }
 
-static void __apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
-			    s32 *start_cfi, s32 *end_cfi, bool builtin)
+static __init_or_module void __apply_fineibt(s32 *start_retpoline,
+					     s32 *end_retpoline, s32 *start_cfi,
+					     s32 *end_cfi, bool builtin)
 {
 	int ret;
 
@@ -1391,8 +1392,8 @@ static void poison_cfi(void *addr) { }
 
 #endif
 
-void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
-		   s32 *start_cfi, s32 *end_cfi)
+__init_or_module void apply_fineibt(s32 *start_retpoline, s32 *end_retpoline,
+				    s32 *start_cfi, s32 *end_cfi)
 {
 	return __apply_fineibt(start_retpoline, end_retpoline,
 			       start_cfi, end_cfi,