From patchwork Wed Jul 19 19:37:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Josh Poimboeuf X-Patchwork-Id: 9853141 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id E31E160388 for ; Wed, 19 Jul 2017 19:37:38 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E40F4285F0 for ; Wed, 19 Jul 2017 19:37:38 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id D85732861F; Wed, 19 Jul 2017 19:37:38 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 12C8C285F0 for ; Wed, 19 Jul 2017 19:37:37 +0000 (UTC) Received: (qmail 25964 invoked by uid 550); 19 Jul 2017 19:37:35 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 25946 invoked from network); 19 Jul 2017 19:37:34 -0000 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 8C221C060202 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=jpoimboe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 8C221C060202 Date: Wed, 19 Jul 2017 14:37:18 -0500 From: Josh Poimboeuf To: Kees Cook Cc: Ingo Molnar , Peter Zijlstra , Christoph Hellwig , "Eric W. Biederman" , Andrew Morton , Jann Horn , Eric Biggers , Elena Reshetova , Hans Liljestrand , Greg KH , Alexey Dobriyan , "Serge E. Hallyn" , arozansk@redhat.com, Davidlohr Bueso , Manfred Spraul , "axboe@kernel.dk" , James Bottomley , "x86@kernel.org" , Arnd Bergmann , "David S. Miller" , Rik van Riel , linux-kernel@vger.kernel.org, linux-arch , "kernel-hardening@lists.openwall.com" Message-ID: <20170719193718.bvkkde5apbboudrk@treble> References: <1500422614-94821-1-git-send-email-keescook@chromium.org> <1500422614-94821-3-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <1500422614-94821-3-git-send-email-keescook@chromium.org> User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 19 Jul 2017 19:37:23 +0000 (UTC) Subject: [kernel-hardening] Re: [PATCH v6 2/2] x86/refcount: Implement fast refcount overflow protection X-Virus-Scanned: ClamAV using ClamSMTP On Tue, Jul 18, 2017 at 05:03:34PM -0700, Kees Cook wrote: > +/* > + * Body of refcount error handling: in .text.unlikely, saved into CX the > + * address of the refcount that has entered a bad state, and trigger an > + * exception. Fixup address is back in regular execution flow in .text. > + */ > +#define _REFCOUNT_EXCEPTION \ > + ".pushsection .text.unlikely\n" \ > + "111:\tlea %[counter], %%" _ASM_CX "\n" \ > + "112:\t" ASM_UD0 "\n" \ > + ".popsection\n" \ > + "113:\n" \ > + _ASM_EXTABLE_REFCOUNT(112b, 113b) This confuses the freshly merged objtool 2.0, which is now too smart for its own good. It's reporting some errors like: >> kernel/sched/autogroup.o: warning: objtool: sched_autogroup_exit()+0x48: return with modified stack frame >> kernel/sched/autogroup.o: warning: objtool: .text.unlikely+0x27: stack state mismatch: reg1[3]=-2-40 reg2[3]=-2-24 >> kernel/sched/autogroup.o: warning: objtool: sched_autogroup_exit()+0x14: stack state mismatch: reg1[3]=-2-40 reg2[3]=-2-24 Because the UD instructions are used for both WARN and BUG, objtool doesn't know whether control flow continues past the instruction. So in cases like this, it needs an "unreachable" annotation. Here's a patch to fix it, feel free to squash it into yours: diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h index 13b91e850a02..e7587db3487c 100644 --- a/arch/x86/include/asm/refcount.h +++ b/arch/x86/include/asm/refcount.h @@ -15,6 +15,7 @@ ".pushsection .text.unlikely\n" \ "111:\tlea %[counter], %%" _ASM_CX "\n" \ "112:\t" ASM_UD0 "\n" \ + ASM_UNREACHABLE \ ".popsection\n" \ "113:\n" \ _ASM_EXTABLE_REFCOUNT(112b, 113b) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index cd4bbe8242bd..85e0b8f42ca0 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -202,15 +202,25 @@ #endif #ifdef CONFIG_STACK_VALIDATION + #define annotate_unreachable() ({ \ asm("%c0:\t\n" \ - ".pushsection .discard.unreachable\t\n" \ - ".long %c0b - .\t\n" \ - ".popsection\t\n" : : "i" (__LINE__)); \ + ".pushsection .discard.unreachable\n\t" \ + ".long %c0b - .\n\t" \ + ".popsection\n\t" : : "i" (__LINE__)); \ }) + +#define ASM_UNREACHABLE \ + "999: .pushsection .discard.unreachable\n\t" \ + ".long 999b - .\n\t" \ + ".popsection\n\t" + #else + #define annotate_unreachable() -#endif +#define ASM_UNREACHABLE + +#endif /* CONFIG_STACK_VALIDATION */ /* * Mark a position in code as unreachable. This can be used to