From patchwork Wed Apr 17 23:53:51 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Yuxuan Luo X-Patchwork-Id: 1924767 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4VKd6l5dG5z1yZx for ; Thu, 18 Apr 2024 09:54:23 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1rxF6V-0005ha-MD; Wed, 17 Apr 2024 23:54:15 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1rxF6P-0005g8-9C for kernel-team@lists.ubuntu.com; Wed, 17 Apr 2024 23:54:09 +0000 Received: from mail-qk1-f200.google.com (mail-qk1-f200.google.com [209.85.222.200]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 64BF73F36F for ; Wed, 17 Apr 2024 23:54:08 +0000 (UTC) Received: by mail-qk1-f200.google.com with SMTP id af79cd13be357-78f08178393so88857485a.1 for ; Wed, 17 Apr 2024 16:54:08 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1713398047; x=1714002847; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=YZINL8qofclSEl3yuhPJR+m+n3mbrLWIzgMntNu3Diw=; b=KogOOrRtifbdjL/ph+Jqu4UGxXbFyxY23FfDnSqhIQaXnYwWtg8+4As2GNwVQz18QL MQBxeOLum5cTUT9FVxawAIMfAF4DxVwPWi9W2zYEKo1gL1uwUQz15Z1t3MkMFClk4EUr rzhbZL2+vNizDXN/WWqi0uw/qmEYgAvbXwqcSetTqgloC6eW8EaGZV8B/iOd5dVj6MT0 57DrDdt4Vx4imMbBB7IDrrzL1mOoIfeUk2Up1JF6xj6iNBU/hYZIZB+7LJcp8vbCXuxR Cbz5Qjw0UwfPna6yQzJKjUgbMQEVsSaHI6qEXBc4gCLWQV3Q4VZEbzepI0+mdfKRdEGl I2tA== X-Gm-Message-State: AOJu0YxEbAr87EMVE7LoHcAt1r3UC0DfLE5dOodVdr9M5eM2hh+IPoPa wualcgtuMtF1IGOlHPYP9DPM/tbD/M7u817YPFvr715GM74xREarnr8e2+xDiWr41c4vCt+eM5g /niehD2Vti6Aj+dDoYhsFjcPk0WV2wVCnVbcugkTT/fjN06uz9uANWodAS8NJFR11kAP5+5m1QN /xZqmlqj2gvv3C X-Received: by 2002:a05:620a:254f:b0:78e:d2ef:3ae0 with SMTP id s15-20020a05620a254f00b0078ed2ef3ae0mr1395559qko.5.1713398047046; Wed, 17 Apr 2024 16:54:07 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFJIuO9lGLKAyW8MZyXvdHYQeZK9s83GMbAGtxXpLcgnpGd8wCFCLi2BF1yfWlLBj/cgNKDEQ== X-Received: by 2002:a05:620a:254f:b0:78e:d2ef:3ae0 with SMTP id s15-20020a05620a254f00b0078ed2ef3ae0mr1395533qko.5.1713398046609; Wed, 17 Apr 2024 16:54:06 -0700 (PDT) Received: from cache-ubuntu.hsd1.nj.comcast.net ([2001:67c:1562:8007::aac:4795]) by smtp.gmail.com with ESMTPSA id x27-20020a05620a099b00b0078d6a0d5728sm129208qkx.29.2024.04.17.16.54.05 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 17 Apr 2024 16:54:06 -0700 (PDT) From: Yuxuan Luo To: kernel-team@lists.ubuntu.com Subject: [PATCH 01/11] objtool: Add support for intra-function calls Date: Wed, 17 Apr 2024 19:53:51 -0400 Message-Id: <20240417235401.243631-2-yuxuan.luo@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20240417235401.243631-1-yuxuan.luo@canonical.com> References: <20240417235401.243631-1-yuxuan.luo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Alexandre Chartre commit 8aa8eb2a8f5b3305a95f39957dd2b715fa668e21 upstream. Change objtool to support intra-function calls. On x86, an intra-function call is represented in objtool as a push onto the stack (of the return address), and a jump to the destination address. That way the stack information is correctly updated and the call flow is still accurate. Signed-off-by: Alexandre Chartre Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Miroslav Benes Acked-by: Josh Poimboeuf Link: https://lkml.kernel.org/r/20200414103618.12657-4-alexandre.chartre@oracle.com Signed-off-by: Rui Qi Signed-off-by: Greg Kroah-Hartman (cherry picked from commit f8f25fde0cc680f6488aea6a0a1f80e689525e18 stable/5.4.y) CVE-2024-2201 Signed-off-by: Yuxuan Luo --- include/linux/frame.h | 11 ++++ .../Documentation/stack-validation.txt | 8 +++ tools/objtool/arch/x86/decode.c | 6 ++ tools/objtool/check.c | 62 +++++++++++++++++-- 4 files changed, 83 insertions(+), 4 deletions(-) diff --git a/include/linux/frame.h b/include/linux/frame.h index 02d3ca2d95985..303cda600e56a 100644 --- a/include/linux/frame.h +++ b/include/linux/frame.h @@ -15,9 +15,20 @@ static void __used __section(.discard.func_stack_frame_non_standard) \ *__func_stack_frame_non_standard_##func = func +/* + * This macro indicates that the following intra-function call is valid. + * Any non-annotated intra-function call will cause objtool to issue a warning. + */ +#define ANNOTATE_INTRA_FUNCTION_CALL \ + 999: \ + .pushsection .discard.intra_function_calls; \ + .long 999b; \ + .popsection; + #else /* !CONFIG_STACK_VALIDATION */ #define STACK_FRAME_NON_STANDARD(func) +#define ANNOTATE_INTRA_FUNCTION_CALL #endif /* CONFIG_STACK_VALIDATION */ diff --git a/tools/objtool/Documentation/stack-validation.txt b/tools/objtool/Documentation/stack-validation.txt index de094670050be..ee26bb382b709 100644 --- a/tools/objtool/Documentation/stack-validation.txt +++ b/tools/objtool/Documentation/stack-validation.txt @@ -290,6 +290,14 @@ they mean, and suggestions for how to fix them. https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70646 +11. file.o: warning: unannotated intra-function call + + This warning means that a direct call is done to a destination which + is not at the beginning of a function. If this is a legit call, you + can remove this warning by putting the ANNOTATE_INTRA_FUNCTION_CALL + directive right before the call. + + If the error doesn't seem to make sense, it could be a bug in objtool. Feel free to ask the objtool maintainer for help. diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c index a62e032863a89..c3ff62c085c83 100644 --- a/tools/objtool/arch/x86/decode.c +++ b/tools/objtool/arch/x86/decode.c @@ -437,6 +437,12 @@ int arch_decode_instruction(struct elf *elf, struct section *sec, case 0xe8: *type = INSN_CALL; + /* + * For the impact on the stack, a CALL behaves like + * a PUSH of an immediate value (the return address). + */ + op->src.type = OP_SRC_CONST; + op->dest.type = OP_DEST_PUSH; break; case 0xfc: diff --git a/tools/objtool/check.c b/tools/objtool/check.c index dfd67243faac0..5165c2e0fb37d 100644 --- a/tools/objtool/check.c +++ b/tools/objtool/check.c @@ -645,6 +645,7 @@ static int add_jump_destinations(struct objtool_file *file) return 0; } + /* * Find the destination instructions for all calls. */ @@ -666,10 +667,7 @@ static int add_call_destinations(struct objtool_file *file) dest_off); if (!insn->call_dest && !insn->ignore) { - WARN_FUNC("unsupported intra-function call", - insn->sec, insn->offset); - if (retpoline) - WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); + WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset); return -1; } @@ -1291,6 +1289,58 @@ static int read_retpoline_hints(struct objtool_file *file) return 0; } + +static int read_intra_function_calls(struct objtool_file *file) +{ + struct instruction *insn; + struct section *sec; + struct rela *rela; + + sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls"); + if (!sec) + return 0; + + list_for_each_entry(rela, &sec->rela_list, list) { + unsigned long dest_off; + + if (rela->sym->type != STT_SECTION) { + WARN("unexpected relocation symbol type in %s", + sec->name); + return -1; + } + + insn = find_insn(file, rela->sym->sec, rela->addend); + if (!insn) { + WARN("bad .discard.intra_function_call entry"); + return -1; + } + + if (insn->type != INSN_CALL) { + WARN_FUNC("intra_function_call not a direct call", + insn->sec, insn->offset); + return -1; + } + + /* + * Treat intra-function CALLs as JMPs, but with a stack_op. + * See add_call_destinations(), which strips stack_ops from + * normal CALLs. + */ + insn->type = INSN_JUMP_UNCONDITIONAL; + + dest_off = insn->offset + insn->len + insn->immediate; + insn->jump_dest = find_insn(file, insn->sec, dest_off); + if (!insn->jump_dest) { + WARN_FUNC("can't find call dest at %s+0x%lx", + insn->sec, insn->offset, + insn->sec->name, dest_off); + return -1; + } + } + + return 0; +} + static void mark_rodata(struct objtool_file *file) { struct section *sec; @@ -1346,6 +1396,10 @@ static int decode_sections(struct objtool_file *file) if (ret) return ret; + ret = read_intra_function_calls(file); + if (ret) + return ret; + ret = add_call_destinations(file); if (ret) return ret;