linux-kernel - Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <odoambb32hnupncbqfisrlqih2b2ggthhebcrg42e5fg25uxol@xe5veqq52xif>
Date: Wed, 23 Apr 2025 07:54:56 -0700
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: tip-bot2 for Ard Biesheuvel <tip-bot2@...utronix.de>
Cc: linux-tip-commits@...r.kernel.org, Ard Biesheuvel <ardb@...nel.org>, 
	Ingo Molnar <mingo@...nel.org>, Peter Zijlstra <peterz@...radead.org>, linux-efi@...r.kernel.org, 
	x86@...nel.org, linux-kernel@...r.kernel.org
Subject: Re: [tip: x86/boot] x86/boot: Disable jump tables in PIC code

On Wed, Apr 23, 2025 at 07:48:01AM +0000, tip-bot2 for Ard Biesheuvel wrote:
> The following commit has been merged into the x86/boot branch of tip:
> 
> Commit-ID:     121c335b36e02d6aefb72501186e060474fdf33c
> Gitweb:        https://git.kernel.org/tip/121c335b36e02d6aefb72501186e060474fdf33c
> Author:        Ard Biesheuvel <ardb@...nel.org>
> AuthorDate:    Tue, 22 Apr 2025 23:05:11 +02:00
> Committer:     Ingo Molnar <mingo@...nel.org>
> CommitterDate: Wed, 23 Apr 2025 09:30:57 +02:00
> 
> x86/boot: Disable jump tables in PIC code
> 
> objtool already struggles to identify jump tables correctly in non-PIC
> code, where the idiom is something like
> 
>   jmpq  *table(,%idx,8)
> 
> and the table is a list of absolute addresses of jump targets.
> 
> When using -fPIC, both the table reference as well as the jump targets
> are emitted in a RIP-relative manner, resulting in something like
> 
>   leaq    table(%rip), %tbl
>   movslq  (%tbl,%idx,4), %offset
>   addq    %offset, %tbl
>   jmpq    *%tbl
> 
> and the table is a list of offsets of the jump targets relative to the
> start of the entire table.
> 
> Considering that this sequence of instructions can be interleaved with
> other instructions that have nothing to do with the jump table in
> question, it is extremely difficult to infer the control flow by
> deriving the jump targets from the indirect jump, the location of the
> table and the relative offsets it contains.
> 
> So let's not bother and disable jump tables for code built with -fPIC
> under arch/x86/boot/startup.

Hm, does objtool even run on boot code?

-- 
Josh