From patchwork Tue Jan 15 17:02:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ruslan Nikolaev X-Patchwork-Id: 10764837 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 424B91390 for ; Tue, 15 Jan 2019 17:05:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 244C42D95D for ; Tue, 15 Jan 2019 17:05:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 226BF2D965; Tue, 15 Jan 2019 17:05:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.3 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 0682C2D95D for ; Tue, 15 Jan 2019 17:05:30 +0000 (UTC) Received: (qmail 18160 invoked by uid 550); 15 Jan 2019 17:05:27 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Delivered-To: moderator for kernel-hardening@lists.openwall.com Received: (qmail 15527 invoked from network); 15 Jan 2019 17:02:57 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1547571765; bh=5yxR4wcFcMJK4YtryvHN8i+OufYQ1CUmAlZhHnASz+0=; h=Date:From:To:Cc:Subject:References:From:Subject; b=chZUjq48iJTSVJKILAe9z9SLPz4g4VNNO3dQSH1FjsASxVWnQlx12JD7IZCw7EokdfPDGeFpT6va8ALRJ+HhSg/vC58kvOSTNRWNozPrffLpBAjTxqneQ371VAYtJITt89zv/fUmecq3xpIdQFphuCZMmXEm/xq4r1IJE1faQFvx44kQSfKXuFpr3ms+FUnk1z/0qphRY+TB/NX3q/qnec7YdXzXJGvCgtd71BsfkjeU91mqVpMFv2Odu3L0aWLjj8Xz34N4kcSzupW+f30r7ebtkQd3d6Re7tP04gMZZcLhFYfaoayfr25PJBNF3bekQUKgk4GACSmHAkT4UKPJSQ== X-YMail-OSG: 0XkQUhAVM1mXFIrwldPZrxacY0MeCnUO9ZTX0n5HDu0oQKEf6k8tvvgUj7VDKkD m3EDBIroVbt9LU032UpznjR0vp4ljfBOOX4Qv6xjRQckS_fmArF.UFrPswK7I9ImVEqH_5YQvmpl eXhnpCnrvNWnMmqwbhxFFLVrtffTKdis1C_m9CwjjmYd0zQZYGo_8GEeGCRAH7P5RhxnK6y6OOFK FtQyyi9O9ir70ZFDDqhHUxJVCI1hPmC0507n1xnr7uNEQRDwxrzdUGM1bPl_9eyEHNAVwiLDLmxI SMJFivT2rexbdNCb4OMq3R5wAA6y1.eH1HYtI71s5S7CE_u.J_pPuii2.UqnpmdhhYdhB51dV8Xs YmAuYxYToxUE3JGaVvlJiEF80ScVb8pVUTmpcuKXZ7MdxHcMeg7Bk5qIX348bdjiWZp97f7QL6SE eppenuumAK8G5c7bo0hLR055p1zbB5iSwU_XuS7lfo6fspbcpkrTevwMrmH2XxFe7axA.LieWjnW YnAArjLqMmzAXntFyIXmFpL6buayL3ZdRNnLbwQdclcFArmR03NsXgvMpa0oIU2IIRCoH5iGH5vQ 8bA.5yOKlfLXX9hhZG3QF7JD978w6VByEOdUJA0uZ4cg3hAfWewOEpWzMZUKkhJ33PzX_v.pkT8a xbbIGpLrnC0GeXuJzaWAiGZukOA5gadku.pC0b5XntYVNcVkd2iFGya4HE8LtaBQIlr6hquiskbP 0Q0_YqXGGm.Qz7cQ.Db9mjZKMfef5FcXJuGVdQaPxuaiMhEAildu.RxLsS0.CPD2_p.j9iHqrp4n rcEAaExDKOZpPIxxBKlbLRHUX_VU_TIpPm35tVrdcCTf_W59YR8RwkMNF20jBw2kOvDLQOKUN1Dx Eh2wRLgWUxy0ga_DIOyS39Noff.gPvJljjI0zUWVIYjfYhlyzLcsGFvIc_1EczUHkZ1koKRSziJ9 HurA_7DEn423UQek5IN5Bx5x1J6N2_xcHGjMsZuZUxjB8duW0qq67nUalQlgaWm9jSLAUozQnHJ7 3XxvzJcK_1ZXHSyFbClNmMH0vlZsf7..wnAqqzJRR3AIxvL_0HvmNr1KIcvx5tAkUY.0x4Q4pA2j 4hoTgOtsnMg-- Date: Tue, 15 Jan 2019 17:02:42 +0000 (UTC) From: Ruslan Nikolaev To: "kernel-hardening@lists.openwall.com" Cc: Ruslan Nikolaev , "thgarnie@google.com" , "x86@kernel.org" , "kstewart@linuxfoundation.org" , "gregkh@linuxfoundation.org" , "linux-kernel@vger.kernel.org" Message-ID: <720903475.468432.1547571762227@mail.yahoo.com> Subject: [PATCH v1 01/06]: Extending objtool for PIC MIME-Version: 1.0 References: <720903475.468432.1547571762227.ref@mail.yahoo.com> X-Mailer: WebService/1.1.12993 YMailNorrin Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0 X-Virus-Scanned: ClamAV using ClamSMTP Extending objtool for PIC The patch is by Hassan Nadeem and Ruslan Nikolaev. This extends the prior PIE kernel patch (by Thomas Garnier) to also support position-independent modules that can be placed anywhere in the 48/64-bit address space (for better KASLR). Signed-off-by: Ruslan Nikolaev --- check.c | 39 ++++++++++++++++++++++++++++----------- 1 file changed, 28 insertions(+), 11 deletions(-) diff -uprN a/tools/objtool/check.c b/tools/objtool/check.c --- a/tools/objtool/check.c 2019-01-15 11:20:46.047176216 -0500 +++ b/tools/objtool/check.c 2019-01-15 11:20:57.727294197 -0500 @@ -179,7 +179,7 @@ static int __dead_end_function(struct ob return 0; insn = find_insn(file, func->sec, func->offset); - if (!insn->func) + if (!insn || !insn->func) return 0; func_for_each_insn_all(file, func, insn) { @@ -233,6 +233,8 @@ static int __dead_end_function(struct ob static int dead_end_function(struct objtool_file *file, struct symbol *func) { + if (!func) + return 0; return __dead_end_function(file, func, 0); } @@ -581,7 +583,7 @@ static int add_call_destinations(struct struct rela *rela; for_each_insn(file, insn) { - if (insn->type != INSN_CALL) + if (insn->type != INSN_CALL && insn->type != INSN_CALL_DYNAMIC) continue; rela = find_rela_by_dest_range(insn->sec, insn->offset, @@ -590,8 +592,8 @@ static int add_call_destinations(struct dest_off = insn->offset + insn->len + insn->immediate; insn->call_dest = find_symbol_by_offset(insn->sec, dest_off); - - if (!insn->call_dest && !insn->ignore) { + if (!insn->call_dest && !insn->ignore && + insn->type != INSN_CALL_DYNAMIC) { WARN_FUNC("unsupported intra-function call", insn->sec, insn->offset); if (retpoline) @@ -602,8 +604,9 @@ static int add_call_destinations(struct } else if (rela->sym->type == STT_SECTION) { insn->call_dest = find_symbol_by_offset(rela->sym->sec, rela->addend+4); - if (!insn->call_dest || - insn->call_dest->type != STT_FUNC) { + if ((!insn->call_dest || + insn->call_dest->type != STT_FUNC) && + insn->type != INSN_CALL_DYNAMIC) { WARN_FUNC("can't find call dest symbol at %s+0x%x", insn->sec, insn->offset, rela->sym->sec->name, @@ -836,6 +839,11 @@ static int add_switch_table(struct objto struct symbol *pfunc = insn->func->pfunc; unsigned int prev_offset = 0; + /* If PC32 relocations are used (as in PIC), the following logic + * can be broken in many ways. + */ + if (file->ignore_unreachables) + return 0; list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) { if (rela == next_table) break; @@ -1244,7 +1252,7 @@ static int decode_sections(struct objtoo static bool is_fentry_call(struct instruction *insn) { - if (insn->type == INSN_CALL && + if (insn->call_dest && insn->call_dest->type == STT_NOTYPE && !strcmp(insn->call_dest->name, "__fentry__")) return true; @@ -1889,6 +1897,7 @@ static int validate_branch(struct objtoo return 0; case INSN_CALL: + case INSN_CALL_DYNAMIC: if (is_fentry_call(insn)) break; @@ -1898,8 +1907,6 @@ static int validate_branch(struct objtoo if (ret == -1) return 1; - /* fallthrough */ - case INSN_CALL_DYNAMIC: if (!no_fp && func && !has_valid_stack_frame(&state)) { WARN_FUNC("call without frame pointer save/setup", sec, insn->offset); @@ -1929,12 +1936,15 @@ static int validate_branch(struct objtoo break; case INSN_JUMP_DYNAMIC: + /* XXX: Does not work properly with PIC code. */ +#if 0 if (func && list_empty(&insn->alts) && has_modified_stack_frame(&state)) { WARN_FUNC("sibling call from callable instruction with modified stack frame", sec, insn->offset); return 1; } +#endif return 0; @@ -2015,6 +2025,11 @@ static int validate_retpoline(struct obj if (!strcmp(insn->sec->name, ".init.text") && !module) continue; + /* ignore ftrace calls in PIC code */ + if (!insn->call_dest || + !strcmp(insn->call_dest->name, "__fentry__")) + continue; + WARN_FUNC("indirect %s found in RETPOLINE build", insn->sec, insn->offset, insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); @@ -2027,13 +2042,15 @@ static int validate_retpoline(struct obj static bool is_kasan_insn(struct instruction *insn) { - return (insn->type == INSN_CALL && + return ((insn->type == INSN_CALL || insn->type == INSN_CALL_DYNAMIC) && + insn->call_dest && !strcmp(insn->call_dest->name, "__asan_handle_no_return")); } static bool is_ubsan_insn(struct instruction *insn) { - return (insn->type == INSN_CALL && + return ((insn->type == INSN_CALL || insn->type == INSN_CALL_DYNAMIC) && + insn->call_dest && !strcmp(insn->call_dest->name, "__ubsan_handle_builtin_unreachable")); }