linux-kernel - Re: [RFC PATCH] objtool: Skip unannotated intra-function call warning for bl+mflr pattern

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4bea75bc-d3f6-4972-b644-f9b5a4e8bb77@linux.ibm.com>
Date: Fri, 21 Feb 2025 14:20:41 +0530
From: Sathvika Vasireddy <sv@...ux.ibm.com>
To: Josh Poimboeuf <jpoimboe@...nel.org>
Cc: peterz@...radead.org, christophe.leroy@...roup.eu, npiggin@...il.com,
        maddy@...ux.ibm.com, linux-kernel@...r.kernel.org,
        linuxppc-dev@...ts.ozlabs.org, llvm@...ts.linux.dev,
        Sathvika Vasireddy <sv@...ux.ibm.com>
Subject: Re: [RFC PATCH] objtool: Skip unannotated intra-function call warning
 for bl+mflr pattern

Hi Josh, Thanks for the review.

On 2/21/25 1:29 AM, Josh Poimboeuf wrote:
> On Wed, Feb 19, 2025 at 09:50:14PM +0530, Sathvika Vasireddy wrote:
>> Architectures like PowerPC use a pattern where the compiler generates a
>> branch-and-link (bl) instruction that targets the very next instruction,
>> followed by loading the link register (mflr) later. This pattern appears
>> in the code like:
>>
>>   bl .+4
>>   li r5,0
>>   mflr r30
> If I understand correctly, this is basically a fake call which is used
> to get the value of the program counter?

Yes, that's correct.

Also, just out of curiosity, how does x86 do it? Does it not use a 
branch to next instruction approach?

>> Objtool currently warns about this as an "unannotated intra-function
>> call" because find_call_destination() fails to find any symbol at the
>> target offset. Add a check to skip the warning when a branch targets
>> the immediate next instruction in the same function.
>>
>> Reported-by: kernel test robot <lkp@...el.com>
>> Closes: https://lore.kernel.org/oe-kbuild-all/202502180818.XnFdv8I8-lkp@intel.com/
>> Signed-off-by: Sathvika Vasireddy <sv@...ux.ibm.com>
> This should have a Fixes tag as well.
Thanks for catching that. I'll add the Fixes tag.
>
>>   static int add_call_destinations(struct objtool_file *file)
>>   {
>> +	struct instruction *next_insn;
>>   	struct instruction *insn;
>>   	unsigned long dest_off;
>>   	struct symbol *dest;
>> @@ -1625,6 +1626,11 @@ static int add_call_destinations(struct objtool_file *file)
>>   		reloc = insn_reloc(file, insn);
>>   		if (!reloc) {
>>   			dest_off = arch_jump_destination(insn);
>> +
>> +			next_insn = next_insn_same_func(file, insn);
>> +			if (next_insn && dest_off == next_insn->offset)
>> +				continue;
>> +
> This won't work on x86, where an intra-function call is converted to a
> stack-modifying JUMP.  So this should probably be checked in an
> arch-specific function.

Thanks for letting me know, I'll introduce arch_skip_call_warning() to 
handle architecture specific cases in the next patch I send.

Regards,
Sathvika