linux-kernel - Re: objtool errors and warnings with clang-21

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <syqx3hcoksstmadl7yimnwt6kueohkbvwfpoux2v5gsebalign@rq6lynvv5ppr>
Date: Fri, 25 Apr 2025 00:25:54 -0700
From: Josh Poimboeuf <jpoimboe@...nel.org>
To: Arnd Bergmann <arnd@...db.de>
Cc: Peter Zijlstra <peterz@...radead.org>, linux-kernel@...r.kernel.org, 
	Nathan Chancellor <nathan@...nel.org>
Subject: Re: objtool errors and warnings with clang-21

On Thu, Apr 24, 2025 at 02:18:25PM -0700, Josh Poimboeuf wrote:
> On Wed, Apr 23, 2025 at 04:25:54PM +0200, Arnd Bergmann wrote:
> > Here is a list of issues I currently see with linux-next and llvm-21 from
> > https://apt.llvm.org/bookworm, along with the .config files:
> > 
> > https://pastebin.com/mRxkgudJ 
> > drivers/gpu/drm/vmwgfx/vmwgfx_msg.o: warning: objtool: vmw_host_printf+0xe: unknown CFA base reg 0
> > make[8]: *** [/home/arnd/arm-soc/scripts/Makefile.build:195: drivers/gpu/drm/vmwgfx/vmwgfx_msg.o] Error 255

This is KMSAN using a new register (%rax) for the DRAP prologue.  I have
a pending fix for this one which adds %rax support to ORC.

> > https://pastebin.com/7XEcstHP
> > drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x17f: undefined stack state
> > drivers/input/misc/uinput.o: warning: objtool: uinput_str_to_user+0x17c: unknown CFA base reg -1
> > make[7]: *** [/home/arnd/arm-soc/scripts/Makefile.build:195: drivers/input/misc/uinput.o] Error 255
> > 
> > https://pastebin.com/6wAzkUL5
> > vmlinux.o: warning: objtool: ___bpf_prog_run+0x208: sibling call from callable instruction with modified stack frame
> > vmlinux.o: warning: objtool: __ubsan_handle_type_mismatch+0xdb: call to __msan_memset() with UACCESS enabled
> > vmlinux.o: warning: objtool: __ubsan_handle_type_mismatch_v1+0xf8: call to __msan_memset() with UACCESS enabled
> > 
> > https://pastebin.com/PQZDZV18
> > fs/fat/dir.o: warning: objtool: fat_ioctl_filldir+0x717: stack state mismatch: cfa1=4+168 cfa2=4+160

I haven't looked at these yet, but they also have KMSAN+UBSAN which
always manages to produce "interesting" code.

> > https://pastebin.com/StQRVCfQ
> > sound/soc/codecs/snd-soc-wcd9335.o: warning: objtool: wcd9335_slimbus_irq() falls through to next function __cfi_wcd9335_set_channel_map()

This is UBSAN inserting undefined behavior due to potential shift out of
bounds (negative shift) in wcd9335_slimbus_irq().  I have a pending fix
(convert i, j, and port_id to unsigned).

> > 
> > and a bunch more fallthrough warnings that are likely all related to that one:
> > 
> > drivers/gpu/drm/amd/amdgpu/../display/dc/basics/fixpt31_32.o: warning: objtool: dc_fixpt_recip() falls through to next function __cfi_dc_fixpt_sinc()
> > drivers/gpu/drm/msm/msm.o: warning: objtool: msm_dp_catalog_ctrl_config_msa() falls through to next function msm_dp_catalog_ctrl_set_pattern_state_bit()
> > drivers/iio/imu/bmi160/bmi160_core.o: warning: objtool: bmi160_setup_irq() falls through to next function bmi160_data_rdy_trigger_set_state()
> > drivers/media/i2c/ccs/ccs-core.o: warning: objtool: ccs_set_selection() falls through to next function ccs_propagate()
> > sound/soc/codecs/aw88399.o: warning: objtool: aw_dev_dsp_update_cfg() falls through to next function aw_dev_get_int_status()

I haven't looked at these yet.  If other recent bugs are any indication,
these are likely caused by undefined behavior triggered by UBSAN and/or
KCOV.  Sometimes the bugs don't seem possible, sometimes they're real.
Either way it's a good idea to tweak the code to avoid the UB.

Usually they're something like a negative shift or divide-by-zero in the
given function.

I'm traveling this weekend, but I can look at these next week if you
send me the configs.  Or, if you want to take a look in the meantime,
the fixes may be fairly obvious if you look for potential UB.

-- 
Josh