| Message ID | 20211013181658.1020262-2-samitolvanen@google.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Headers | show |
| Series | x86: Add support for Clang CFI | expand |
On Wed, Oct 13, 2021 at 11:16:44AM -0700, Sami Tolvanen wrote: > The upcoming CONFIG_CFI_CLANG support uses -fsanitize=cfi, the > non-canonical version of which hijacks function entry by changing > function relocation references to point to an intermediary jump table. > > For example: > > Relocation section '.rela.discard.func_stack_frame_non_standard' at offset 0x37e018 contains 6 entries: > Offset Info Type Symbol's Value Symbol's Name + Addend > 0000000000000000 0002944700000002 R_X86_64_PC32 00000000000023f0 do_suspend_lowlevel + 0 > 0000000000000008 0003c11900000001 R_X86_64_64 0000000000000008 xen_cpuid$e69bc59f4fade3b6f2b579b3934137df.cfi_jt + 0 > 0000000000000010 0003980900000001 R_X86_64_64 0000000000000060 machine_real_restart.cfi_jt + 0 > 0000000000000018 0003962b00000001 R_X86_64_64 0000000000000e18 kretprobe_trampoline.cfi_jt + 0 > 0000000000000020 000028f300000001 R_X86_64_64 0000000000000000 .rodata + 12 > 0000000000000028 000349f400000001 R_X86_64_64 0000000000000018 __crash_kexec.cfi_jt + 0 > > 0000000000000060 <machine_real_restart.cfi_jt>: > 60: e9 00 00 00 00 jmpq 65 <machine_real_restart.cfi_jt+0x5> > 61: R_X86_64_PLT32 machine_real_restart-0x4 > 65: cc int3 > 66: cc int3 > 67: cc int3 > > This breaks objtool vmlinux validation in many ways, including static > call site detection and the STACK_FRAME_NON_STANDARD() macro. > > Fix it by converting those relocations' symbol references back to their > original non-jump-table versions. Note this doesn't change the actual > relocations in the object itself, it just changes objtool's view of > them. This change is based on Josh's initial patch: > > https://lore.kernel.org/r/d743f4b36e120c06506567a9f87a062ae03da47f.1611263462.git.jpoimboe@redhat.com/ > > Reported-by: Sedat Dilek <sedat.dilek@gmail.com> > Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com> > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> This looks really clean. Thanks! Reviewed-by: Kees Cook <keescook@chromium.org>
On Wed, Oct 13, 2021 at 11:16:44AM -0700, Sami Tolvanen wrote: > The upcoming CONFIG_CFI_CLANG support uses -fsanitize=cfi, the > non-canonical version of which hijacks function entry by changing > function relocation references to point to an intermediary jump table. > > For example: > > Relocation section '.rela.discard.func_stack_frame_non_standard' at offset 0x37e018 contains 6 entries: > Offset Info Type Symbol's Value Symbol's Name + Addend > 0000000000000000 0002944700000002 R_X86_64_PC32 00000000000023f0 do_suspend_lowlevel + 0 > 0000000000000008 0003c11900000001 R_X86_64_64 0000000000000008 xen_cpuid$e69bc59f4fade3b6f2b579b3934137df.cfi_jt + 0 > 0000000000000010 0003980900000001 R_X86_64_64 0000000000000060 machine_real_restart.cfi_jt + 0 > 0000000000000018 0003962b00000001 R_X86_64_64 0000000000000e18 kretprobe_trampoline.cfi_jt + 0 > 0000000000000020 000028f300000001 R_X86_64_64 0000000000000000 .rodata + 12 > 0000000000000028 000349f400000001 R_X86_64_64 0000000000000018 __crash_kexec.cfi_jt + 0 > > 0000000000000060 <machine_real_restart.cfi_jt>: > 60: e9 00 00 00 00 jmpq 65 <machine_real_restart.cfi_jt+0x5> > 61: R_X86_64_PLT32 machine_real_restart-0x4 > 65: cc int3 > 66: cc int3 > 67: cc int3 > > This breaks objtool vmlinux validation in many ways, including static > call site detection and the STACK_FRAME_NON_STANDARD() macro. > > Fix it by converting those relocations' symbol references back to their > original non-jump-table versions. Note this doesn't change the actual > relocations in the object itself, it just changes objtool's view of > them. This change is based on Josh's initial patch: > > https://lore.kernel.org/r/d743f4b36e120c06506567a9f87a062ae03da47f.1611263462.git.jpoimboe@redhat.com/ > > Reported-by: Sedat Dilek <sedat.dilek@gmail.com> > Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com> > Signed-off-by: Sami Tolvanen <samitolvanen@google.com> > Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> > Tested-by: Nick Desaulniers <ndesaulniers@google.com> > Tested-by: Sedat Dilek <sedat.dilek@gmail.com> Acked-by: Josh Poimboeuf <jpoimboe@redhat.com>
On Wed, Oct 13, 2021 at 11:16:44AM -0700, Sami Tolvanen wrote: > diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c > index 1f2ae708b223..5fe31523e51f 100644 > --- a/tools/objtool/arch/x86/decode.c > +++ b/tools/objtool/arch/x86/decode.c > @@ -63,6 +63,23 @@ bool arch_callee_saved_reg(unsigned char reg) > } > } > > +unsigned long arch_cfi_section_reloc_offset(struct reloc *reloc) > +{ > + if (!reloc->addend) > + return 0; > + > + if (reloc->type == R_X86_64_PC32 || reloc->type == R_X86_64_PLT32) > + return reloc->addend + 4; > + > + return reloc->addend; > +} > + > +unsigned long arch_cfi_jump_reloc_offset(unsigned long offset) > +{ > + /* offset to the relocation in a jmp instruction */ > + return offset + 1; > +} > + > unsigned long arch_dest_reloc_offset(int addend) > { > return addend + 4; > diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c > index b18f0055b50b..cd09c93c34fb 100644 > --- a/tools/objtool/elf.c > +++ b/tools/objtool/elf.c > @@ -575,6 +580,49 @@ static int read_rela_reloc(struct section *sec, int i, struct reloc *reloc, unsi > return 0; > } > > +/* > + * CONFIG_CFI_CLANG replaces function relocations to refer to an intermediate > + * jump table. Undo the conversion so objtool can make sense of things. > + */ > +static int fix_cfi_relocs(const struct elf *elf) > +{ > + struct section *sec; > + struct reloc *reloc; > + > + list_for_each_entry(sec, &elf->sections, list) { > + list_for_each_entry(reloc, &sec->reloc_list, list) { > + struct reloc *cfi_reloc; > + unsigned long offset; > + > + if (!reloc->sym->sec->cfi_jt) > + continue; > + > + if (reloc->sym->type == STT_SECTION) > + offset = arch_cfi_section_reloc_offset(reloc); > + else > + offset = reloc->sym->offset; > + > + /* > + * The jump table immediately jumps to the actual function, > + * so look up the relocation there. > + */ > + offset = arch_cfi_jump_reloc_offset(offset); > + cfi_reloc = find_reloc_by_dest(elf, reloc->sym->sec, offset); > + > + if (!cfi_reloc || !cfi_reloc->sym) { > + WARN("can't find a CFI jump table relocation at %s+0x%lx", > + reloc->sym->sec->name, offset); > + return -1; > + } > + > + reloc->sym = cfi_reloc->sym; > + reloc->addend = 0; > + } > + } > + > + return 0; > +} If that section ever gets modified and we end up running elf_rebuild_reloc_section() on it, we're in trouble, right? Do we want a fatal error in elf_rebuild_reloc_section() when ->cfi_jt is set?
On Thu, Oct 14, 2021 at 3:23 AM Peter Zijlstra <peterz@infradead.org> wrote: > > On Wed, Oct 13, 2021 at 11:16:44AM -0700, Sami Tolvanen wrote: > > diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c > > index 1f2ae708b223..5fe31523e51f 100644 > > --- a/tools/objtool/arch/x86/decode.c > > +++ b/tools/objtool/arch/x86/decode.c > > @@ -63,6 +63,23 @@ bool arch_callee_saved_reg(unsigned char reg) > > } > > } > > > > +unsigned long arch_cfi_section_reloc_offset(struct reloc *reloc) > > +{ > > + if (!reloc->addend) > > + return 0; > > + > > + if (reloc->type == R_X86_64_PC32 || reloc->type == R_X86_64_PLT32) > > + return reloc->addend + 4; > > + > > + return reloc->addend; > > +} > > + > > +unsigned long arch_cfi_jump_reloc_offset(unsigned long offset) > > +{ > > + /* offset to the relocation in a jmp instruction */ > > + return offset + 1; > > +} > > + > > unsigned long arch_dest_reloc_offset(int addend) > > { > > return addend + 4; > > diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c > > index b18f0055b50b..cd09c93c34fb 100644 > > --- a/tools/objtool/elf.c > > +++ b/tools/objtool/elf.c > > > @@ -575,6 +580,49 @@ static int read_rela_reloc(struct section *sec, int i, struct reloc *reloc, unsi > > return 0; > > } > > > > +/* > > + * CONFIG_CFI_CLANG replaces function relocations to refer to an intermediate > > + * jump table. Undo the conversion so objtool can make sense of things. > > + */ > > +static int fix_cfi_relocs(const struct elf *elf) > > +{ > > + struct section *sec; > > + struct reloc *reloc; > > + > > + list_for_each_entry(sec, &elf->sections, list) { > > + list_for_each_entry(reloc, &sec->reloc_list, list) { > > + struct reloc *cfi_reloc; > > + unsigned long offset; > > + > > + if (!reloc->sym->sec->cfi_jt) > > + continue; > > + > > + if (reloc->sym->type == STT_SECTION) > > + offset = arch_cfi_section_reloc_offset(reloc); > > + else > > + offset = reloc->sym->offset; > > + > > + /* > > + * The jump table immediately jumps to the actual function, > > + * so look up the relocation there. > > + */ > > + offset = arch_cfi_jump_reloc_offset(offset); > > + cfi_reloc = find_reloc_by_dest(elf, reloc->sym->sec, offset); > > + > > + if (!cfi_reloc || !cfi_reloc->sym) { > > + WARN("can't find a CFI jump table relocation at %s+0x%lx", > > + reloc->sym->sec->name, offset); > > + return -1; > > + } > > + > > + reloc->sym = cfi_reloc->sym; > > + reloc->addend = 0; > > + } > > + } > > + > > + return 0; > > +} > > If that section ever gets modified and we end up running > elf_rebuild_reloc_section() on it, we're in trouble, right? > > Do we want a fatal error in elf_rebuild_reloc_section() when ->cfi_jt is > set? That's a valid point. Since ->cfi_jt is only set for jump table sections, I think we'll need a different flag for this though. Sami
diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c index 1f2ae708b223..5fe31523e51f 100644 --- a/tools/objtool/arch/x86/decode.c +++ b/tools/objtool/arch/x86/decode.c @@ -63,6 +63,23 @@ bool arch_callee_saved_reg(unsigned char reg) } } +unsigned long arch_cfi_section_reloc_offset(struct reloc *reloc) +{ + if (!reloc->addend) + return 0; + + if (reloc->type == R_X86_64_PC32 || reloc->type == R_X86_64_PLT32) + return reloc->addend + 4; + + return reloc->addend; +} + +unsigned long arch_cfi_jump_reloc_offset(unsigned long offset) +{ + /* offset to the relocation in a jmp instruction */ + return offset + 1; +} + unsigned long arch_dest_reloc_offset(int addend) { return addend + 4; diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index b18f0055b50b..cd09c93c34fb 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -18,6 +18,7 @@ #include <errno.h> #include <objtool/builtin.h> +#include <objtool/arch.h> #include <objtool/elf.h> #include <objtool/warn.h> @@ -290,6 +291,10 @@ static int read_sections(struct elf *elf) if (sec->sh.sh_flags & SHF_EXECINSTR) elf->text_size += sec->sh.sh_size; + /* Detect -fsanitize=cfi jump table sections */ + if (!strncmp(sec->name, ".text..L.cfi.jumptable", 22)) + sec->cfi_jt = true; + list_add_tail(&sec->list, &elf->sections); elf_hash_add(section, &sec->hash, sec->idx); elf_hash_add(section_name, &sec->name_hash, str_hash(sec->name)); @@ -575,6 +580,49 @@ static int read_rela_reloc(struct section *sec, int i, struct reloc *reloc, unsi return 0; } +/* + * CONFIG_CFI_CLANG replaces function relocations to refer to an intermediate + * jump table. Undo the conversion so objtool can make sense of things. + */ +static int fix_cfi_relocs(const struct elf *elf) +{ + struct section *sec; + struct reloc *reloc; + + list_for_each_entry(sec, &elf->sections, list) { + list_for_each_entry(reloc, &sec->reloc_list, list) { + struct reloc *cfi_reloc; + unsigned long offset; + + if (!reloc->sym->sec->cfi_jt) + continue; + + if (reloc->sym->type == STT_SECTION) + offset = arch_cfi_section_reloc_offset(reloc); + else + offset = reloc->sym->offset; + + /* + * The jump table immediately jumps to the actual function, + * so look up the relocation there. + */ + offset = arch_cfi_jump_reloc_offset(offset); + cfi_reloc = find_reloc_by_dest(elf, reloc->sym->sec, offset); + + if (!cfi_reloc || !cfi_reloc->sym) { + WARN("can't find a CFI jump table relocation at %s+0x%lx", + reloc->sym->sec->name, offset); + return -1; + } + + reloc->sym = cfi_reloc->sym; + reloc->addend = 0; + } + } + + return 0; +} + static int read_relocs(struct elf *elf) { struct section *sec; @@ -638,6 +686,9 @@ static int read_relocs(struct elf *elf) tot_reloc += nr_reloc; } + if (fix_cfi_relocs(elf)) + return -1; + if (stats) { printf("max_reloc: %lu\n", max_reloc); printf("tot_reloc: %lu\n", tot_reloc); diff --git a/tools/objtool/include/objtool/arch.h b/tools/objtool/include/objtool/arch.h index 589ff58426ab..93bde8aaf2e3 100644 --- a/tools/objtool/include/objtool/arch.h +++ b/tools/objtool/include/objtool/arch.h @@ -81,6 +81,9 @@ unsigned long arch_jump_destination(struct instruction *insn); unsigned long arch_dest_reloc_offset(int addend); +unsigned long arch_cfi_section_reloc_offset(struct reloc *reloc); +unsigned long arch_cfi_jump_reloc_offset(unsigned long offset); + const char *arch_nop_insn(int len); const char *arch_ret_insn(int len); diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h index c48c1067797d..e9432be2a0b0 100644 --- a/tools/objtool/include/objtool/elf.h +++ b/tools/objtool/include/objtool/elf.h @@ -38,7 +38,7 @@ struct section { Elf_Data *data; char *name; int idx; - bool changed, text, rodata, noinstr; + bool changed, text, rodata, noinstr, cfi_jt; }; struct symbol {
The upcoming CONFIG_CFI_CLANG support uses -fsanitize=cfi, the non-canonical version of which hijacks function entry by changing function relocation references to point to an intermediary jump table. For example: Relocation section '.rela.discard.func_stack_frame_non_standard' at offset 0x37e018 contains 6 entries: Offset Info Type Symbol's Value Symbol's Name + Addend 0000000000000000 0002944700000002 R_X86_64_PC32 00000000000023f0 do_suspend_lowlevel + 0 0000000000000008 0003c11900000001 R_X86_64_64 0000000000000008 xen_cpuid$e69bc59f4fade3b6f2b579b3934137df.cfi_jt + 0 0000000000000010 0003980900000001 R_X86_64_64 0000000000000060 machine_real_restart.cfi_jt + 0 0000000000000018 0003962b00000001 R_X86_64_64 0000000000000e18 kretprobe_trampoline.cfi_jt + 0 0000000000000020 000028f300000001 R_X86_64_64 0000000000000000 .rodata + 12 0000000000000028 000349f400000001 R_X86_64_64 0000000000000018 __crash_kexec.cfi_jt + 0 0000000000000060 <machine_real_restart.cfi_jt>: 60: e9 00 00 00 00 jmpq 65 <machine_real_restart.cfi_jt+0x5> 61: R_X86_64_PLT32 machine_real_restart-0x4 65: cc int3 66: cc int3 67: cc int3 This breaks objtool vmlinux validation in many ways, including static call site detection and the STACK_FRAME_NON_STANDARD() macro. Fix it by converting those relocations' symbol references back to their original non-jump-table versions. Note this doesn't change the actual relocations in the object itself, it just changes objtool's view of them. This change is based on Josh's initial patch: https://lore.kernel.org/r/d743f4b36e120c06506567a9f87a062ae03da47f.1611263462.git.jpoimboe@redhat.com/ Reported-by: Sedat Dilek <sedat.dilek@gmail.com> Suggested-by: Josh Poimboeuf <jpoimboe@redhat.com> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com> Tested-by: Nick Desaulniers <ndesaulniers@google.com> Tested-by: Sedat Dilek <sedat.dilek@gmail.com> --- tools/objtool/arch/x86/decode.c | 17 ++++++++++ tools/objtool/elf.c | 51 ++++++++++++++++++++++++++++ tools/objtool/include/objtool/arch.h | 3 ++ tools/objtool/include/objtool/elf.h | 2 +- 4 files changed, 72 insertions(+), 1 deletion(-)