netdev - Re: [PATCH v2 2/5] objtool: Fix ORC unwinding in non-JIT BPF generated code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190614211929.drnnawbi7guqj2ck@treble>
Date:   Fri, 14 Jun 2019 16:19:29 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     X86 ML <x86@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Network Development <netdev@...r.kernel.org>,
        bpf <bpf@...r.kernel.org>, Peter Zijlstra <peterz@...radead.org>,
        Song Liu <songliubraving@...com>,
        Kairui Song <kasong@...hat.com>,
        Steven Rostedt <rostedt@...dmis.org>,
        David Laight <David.Laight@...lab.com>,
        Thomas Gleixner <tglx@...utronix.de>,
        Borislav Petkov <bp@...en8.de>, Ingo Molnar <mingo@...nel.org>
Subject: Re: [PATCH v2 2/5] objtool: Fix ORC unwinding in non-JIT BPF
 generated code

On Fri, Jun 14, 2019 at 02:09:25PM -0700, Alexei Starovoitov wrote:
> On Fri, Jun 14, 2019 at 2:07 PM Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> >
> > On Fri, Jun 14, 2019 at 01:58:42PM -0700, Alexei Starovoitov wrote:
> > > On Fri, Jun 14, 2019 at 12:56:41PM -0500, Josh Poimboeuf wrote:
> > > > Objtool currently ignores ___bpf_prog_run() because it doesn't
> > > > understand the jump table.  This results in the ORC unwinder not being
> > > > able to unwind through non-JIT BPF code.
> > > >
> > > > Luckily, the BPF jump table resembles a GCC switch jump table, which
> > > > objtool already knows how to read.
> > > >
> > > > Add generic support for reading any static local jump table array named
> > > > "jump_table", and rename the BPF variable accordingly, so objtool can
> > > > generate ORC data for ___bpf_prog_run().
> > > >
> > > > Fixes: d15d356887e7 ("perf/x86: Make perf callchains work without CONFIG_FRAME_POINTER")
> > > > Reported-by: Song Liu <songliubraving@...com>
> > > > Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>
> > > > Acked-by: Peter Zijlstra (Intel) <peterz@...radead.org>
> > > > ---
> > > >  kernel/bpf/core.c     |  5 ++---
> > > >  tools/objtool/check.c | 16 ++++++++++++++--
> > > >  2 files changed, 16 insertions(+), 5 deletions(-)
> > > >
> > > > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > > > index 7c473f208a10..aa546ef7dbdc 100644
> > > > --- a/kernel/bpf/core.c
> > > > +++ b/kernel/bpf/core.c
> > > > @@ -1299,7 +1299,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
> > > >  {
> > > >  #define BPF_INSN_2_LBL(x, y)    [BPF_##x | BPF_##y] = &&x##_##y
> > > >  #define BPF_INSN_3_LBL(x, y, z) [BPF_##x | BPF_##y | BPF_##z] = &&x##_##y##_##z
> > > > -   static const void *jumptable[256] = {
> > > > +   static const void *jump_table[256] = {
> > > >             [0 ... 255] = &&default_label,
> > > >             /* Now overwrite non-defaults ... */
> > > >             BPF_INSN_MAP(BPF_INSN_2_LBL, BPF_INSN_3_LBL),
> > > > @@ -1315,7 +1315,7 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
> > > >  #define CONT_JMP ({ insn++; goto select_insn; })
> > > >
> > > >  select_insn:
> > > > -   goto *jumptable[insn->code];
> > > > +   goto *jump_table[insn->code];
> > > >
> > > >     /* ALU */
> > > >  #define ALU(OPCODE, OP)                    \
> > > > @@ -1558,7 +1558,6 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
> > > >             BUG_ON(1);
> > > >             return 0;
> > > >  }
> > > > -STACK_FRAME_NON_STANDARD(___bpf_prog_run); /* jump table */
> > > >
> > > >  #define PROG_NAME(stack_size) __bpf_prog_run##stack_size
> > > >  #define DEFINE_BPF_PROG_RUN(stack_size) \
> > > > diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> > > > index 172f99195726..8341c2fff14f 100644
> > > > --- a/tools/objtool/check.c
> > > > +++ b/tools/objtool/check.c
> > > > @@ -18,6 +18,8 @@
> > > >
> > > >  #define FAKE_JUMP_OFFSET -1
> > > >
> > > > +#define JUMP_TABLE_SYM_PREFIX "jump_table."
> > >
> > > since external tool will be looking at it should it be named
> > > "bpf_jump_table." to avoid potential name conflicts?
> > > Or even more unique name?
> > > Like "bpf_interpreter_jump_table." ?
> >
> > No, the point is that it's a generic feature which can also be used any
> > non-BPF code which might also have a jump table.
> 
> and you're proposing to name all such jump tables in the kernel
> as static foo jump_table[] ?

That's the idea.

-- 
Josh