Message-ID: <20241011170847.334429-10-ardb+git@google.com>
Date: Fri, 11 Oct 2024 19:08:48 +0200
From: Ard Biesheuvel <ardb+git@...gle.com>
To: linux-kernel@...r.kernel.org
Cc: llvm@...ts.linux.dev, keescook@...omium.org, 
	linux-hardening@...r.kernel.org, nathan@...nel.org, 
	Ard Biesheuvel <ardb@...nel.org>, Josh Poimboeuf <jpoimboe@...nel.org>, 
	Peter Zijlstra <peterz@...radead.org>, Jan Beulich <jbeulich@...e.com>, 
	"Jose E. Marchesi" <jemarch@....org>, Kees Cook <kees@...nel.org>
Subject: [PATCH v3 0/8] Improve objtool jump table handling

From: Ard Biesheuvel <ardb@...nel.org>

Jump table handling has faded into the background a little due to the
fact that jump tables are [currently] disabled when enabling retpoline
mitigations and/or IBT on x86.

However, this is likely to come back and bite us later, so it still
needs to be addressed. Given the difficulty in identifying jump tables
from .rodata references and indirect jump instructions that often have
no obvious correlation, it would be better to do this in the compiler.

This series implements [on the objtool side] the suggestion made at GNU
Cauldron this year to annotate the indirect jump with a R_X86_64_NONE
relocation that refers to the jump table, and ensure that it is covered
by a STT_OBJECT symbol whose size accurately reflects the size of the
jump table.

This can be wired up in objtool with minimal effort. The only
complication is that indirect jumps may be direct jumps in disguise, if
they target retpoline thunks. This will result in more than one
relocation attached to the same instruction, which needs careful
handling in objtool.

Other than that, changes are rather straight-forward.

Patches #6 - #8 update the CRC32C driver, which has a jump table
implemented in assembler, to
a) use a relative jump table, for compatibility with linking in PIE mode
b) add the jump table annotation
c) make the jump table more difficult to identify by objtool's existing
   heuristics, so that it will fail to identify it without the
   annotation.

Changes since v2:
- drastic refactoring of the annotation handling so that generic users
  (non-x86) get it as well, with the x86 heuristics moved to a x86
  specific source file
- use generic reloc type identifiers where appropriate
- update insn->no_reloc where appropriate

Changes since v1:
- tweak logic in patch #1 to ensure that all jump table entries are
  covered by the same type of relocation
- use the corrected addend when validating IBT targets
- add patches #2 - #5

Cc: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Jan Beulich <jbeulich@...e.com>
Cc: "Jose E. Marchesi" <jemarch@....org>
Cc: Kees Cook <kees@...nel.org>

Ard Biesheuvel (8):
  objtool: Deal with relative jump tables correctly
  objtool: Allow arch code to discover jump table size
  objtool: Make some helper functions globally accessible
  objtool: Move jump table heuristics to a x86 specific source file
  objtool: Add generic support for jump table annotations
  crypto: x86/crc32c - Use idiomatic relative jump table
  crypto: x86/crc32c - Add jump table annotation
  crypto: x86/crc32c-intel - Tweaks to make objtool's life harder

 arch/x86/crypto/crc32c-pcl-intel-asm_64.S |  50 +++--
 tools/objtool/arch/loongarch/special.c    |   6 -
 tools/objtool/arch/powerpc/special.c      |   6 -
 tools/objtool/arch/x86/special.c          | 160 ++++++++++++----
 tools/objtool/check.c                     | 199 ++++++++++----------
 tools/objtool/include/objtool/check.h     |  25 ++-
 tools/objtool/include/objtool/elf.h       |   6 +
 tools/objtool/include/objtool/special.h   |   8 +-
 8 files changed, 287 insertions(+), 173 deletions(-)

-- 
2.47.0.rc1.288.g06298d1525-goog

Powered by blists - more mailing lists