linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Peter Zijlstra <peterz@infradead.org>
To: torvalds@linux-foundation.org, tglx@linutronix.de, hpa@zytor.com,
	julien.thierry@arm.com, will.deacon@arm.com, luto@amacapital.net,
	mingo@kernel.org, catalin.marinas@arm.com, james.morse@arm.com,
	valentin.schneider@arm.com, brgerst@gmail.com,
	jpoimboe@redhat.com, luto@kernel.org, bp@alien8.de,
	dvlasenk@redhat.com
Cc: linux-kernel@vger.kernel.org, peterz@infradead.org,
	dvyukov@google.com, rostedt@goodmis.org
Subject: [PATCH 17/20] objtool: Fix sibling call detection
Date: Thu, 07 Mar 2019 12:45:28 +0100	[thread overview]
Message-ID: <20190307115200.605521081@infradead.org> (raw)
In-Reply-To: 20190307114511.870090179@infradead.org

It turned out that we failed to detect some sibling calls;
specifically those without relocation records; like:

$ ./objdump-func.sh defconfig-build/mm/kasan/generic.o __asan_loadN
0000 0000000000000840 <__asan_loadN>:
0000  840:      48 8b 0c 24             mov    (%rsp),%rcx
0004  844:      31 d2                   xor    %edx,%edx
0006  846:      e9 45 fe ff ff          jmpq   690 <check_memory_region>

So extend the cross-function jump to also consider those that are not
between known (or newly detected) parent/child functions, as
sibling-cals when they jump to the start of the function.

The second part of that condition is to deal with random jumps to the
middle of other function, as can be found in
arch/x86/lib/copy_user_64.S for example.

This then (with later patches applied) makes the above recognise the
sibling call:

mm/kasan/generic.o: warning: objtool: __asan_loadN()+0x6: call to check_memory_region() with UACCESS enabled

Also make sure to set insn->call_dest for sibling calls so we can know
who we're calling.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
---
 tools/objtool/check.c |   79 +++++++++++++++++++++++++++++---------------------
 1 file changed, 46 insertions(+), 33 deletions(-)

--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -515,7 +515,8 @@ static int add_jump_destinations(struct
 			continue;
 		} else {
 			/* sibling call */
-			insn->jump_dest = 0;
+			insn->call_dest = rela->sym;
+			insn->jump_dest = NULL;
 			continue;
 		}
 
@@ -537,25 +538,38 @@ static int add_jump_destinations(struct
 		}
 
 		/*
-		 * For GCC 8+, create parent/child links for any cold
-		 * subfunctions.  This is _mostly_ redundant with a similar
-		 * initialization in read_symbols().
-		 *
-		 * If a function has aliases, we want the *first* such function
-		 * in the symbol table to be the subfunction's parent.  In that
-		 * case we overwrite the initialization done in read_symbols().
-		 *
-		 * However this code can't completely replace the
-		 * read_symbols() code because this doesn't detect the case
-		 * where the parent function's only reference to a subfunction
-		 * is through a switch table.
+		 * Cross-function jump.
 		 */
 		if (insn->func && insn->jump_dest->func &&
-		    insn->func != insn->jump_dest->func &&
-		    !strstr(insn->func->name, ".cold.") &&
-		    strstr(insn->jump_dest->func->name, ".cold.")) {
-			insn->func->cfunc = insn->jump_dest->func;
-			insn->jump_dest->func->pfunc = insn->func;
+		    insn->func != insn->jump_dest->func) {
+
+			/*
+			 * For GCC 8+, create parent/child links for any cold
+			 * subfunctions.  This is _mostly_ redundant with a
+			 * similar initialization in read_symbols().
+			 *
+			 * If a function has aliases, we want the *first* such
+			 * function in the symbol table to be the subfunction's
+			 * parent.  In that case we overwrite the
+			 * initialization done in read_symbols().
+			 *
+			 * However this code can't completely replace the
+			 * read_symbols() code because this doesn't detect the
+			 * case where the parent function's only reference to a
+			 * subfunction is through a switch table.
+			 */
+			if (!strstr(insn->func->name, ".cold.") &&
+			    strstr(insn->jump_dest->func->name, ".cold.")) {
+				insn->func->cfunc = insn->jump_dest->func;
+				insn->jump_dest->func->pfunc = insn->func;
+
+			} else if (insn->jump_dest->func->pfunc != insn->func->pfunc &&
+				   insn->jump_dest->offset == insn->jump_dest->func->offset) {
+
+				/* sibling class */
+				insn->call_dest = insn->jump_dest->func;
+				insn->jump_dest = NULL;
+			}
 		}
 	}
 
@@ -1935,9 +1949,16 @@ static int validate_branch(struct objtoo
 
 		case INSN_JUMP_CONDITIONAL:
 		case INSN_JUMP_UNCONDITIONAL:
-			if (insn->jump_dest &&
-			    (!func || !insn->jump_dest->func ||
-			     insn->jump_dest->func->pfunc == func)) {
+			if (func && !insn->jump_dest) {
+do_sibling_call:
+				if (has_modified_stack_frame(&state)) {
+					WARN_FUNC("sibling call from callable instruction with modified stack frame",
+							sec, insn->offset);
+					return 1;
+				}
+			} else if (insn->jump_dest &&
+				   (!func || !insn->jump_dest->func ||
+				    insn->jump_dest->func->pfunc == func)) {
 				ret = validate_branch(file, insn->jump_dest,
 						      state);
 				if (ret) {
@@ -1945,25 +1966,17 @@ static int validate_branch(struct objtoo
 						BT_FUNC("(branch)", insn);
 					return ret;
 				}
-
-			} else if (func && has_modified_stack_frame(&state)) {
-				WARN_FUNC("sibling call from callable instruction with modified stack frame",
-					  sec, insn->offset);
-				return 1;
 			}
 
-			if (insn->type == INSN_JUMP_UNCONDITIONAL)
+			if (insn->type == INSN_JUMP_UNCONDITIONAL ||
+			    insn->type == INSN_JUMP_DYNAMIC)
 				return 0;
 
 			break;
 
 		case INSN_JUMP_DYNAMIC:
-			if (func && list_empty(&insn->alts) &&
-			    has_modified_stack_frame(&state)) {
-				WARN_FUNC("sibling call from callable instruction with modified stack frame",
-					  sec, insn->offset);
-				return 1;
-			}
+			if (func && list_empty(&insn->alts))
+				goto do_sibling_call;
 
 			return 0;
 



  parent reply	other threads:[~2019-03-07 11:53 UTC|newest]

Thread overview: 100+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-07 11:45 [PATCH 00/20] objtool: UACCESS validation v3 Peter Zijlstra
2019-03-07 11:45 ` [PATCH 01/20] x86/ia32: Fix ia32_restore_sigcontext AC leak Peter Zijlstra
2019-03-07 11:45 ` [PATCH 02/20] i915,uaccess: Fix redundant CLAC Peter Zijlstra
2019-03-07 11:45 ` [PATCH 03/20] x86/uaccess: Move copy_user_handle_tail into asm Peter Zijlstra
2019-03-08 18:53   ` Josh Poimboeuf
2019-03-08 19:48     ` Peter Zijlstra
2019-03-08 19:53       ` Josh Poimboeuf
2019-03-10 13:22         ` Peter Zijlstra
2019-03-07 11:45 ` [PATCH 04/20] x86/uaccess: Fix up the fixup Peter Zijlstra
2019-03-07 11:45 ` [PATCH 05/20] x86/uaccess/xen: Suppress SMAP warnings Peter Zijlstra
2019-03-07 12:22   ` Juergen Gross
2019-03-07 12:32     ` Peter Zijlstra
2019-03-07 12:36       ` Juergen Gross
2019-03-08 19:00   ` Josh Poimboeuf
2019-03-08 19:03     ` Josh Poimboeuf
2019-03-10 13:19       ` Peter Zijlstra
2019-03-11 17:59         ` Josh Poimboeuf
2019-03-08 19:50     ` Peter Zijlstra
2019-03-07 11:45 ` [PATCH 06/20] x86/uaccess: Always inline user_access_begin() Peter Zijlstra
2019-03-07 11:45 ` [PATCH 07/20] x86/uaccess: Always inline force_valid_ss() Peter Zijlstra
2019-03-07 13:50   ` Peter Zijlstra
2019-03-07 18:05   ` Andy Lutomirski
2019-03-07 18:59     ` Peter Zijlstra
2019-03-07 19:06       ` Andy Lutomirski
2019-03-07 11:45 ` [PATCH 08/20] x86/uaccess: Introduce user_access_{save,restore}() Peter Zijlstra
2019-03-07 11:45 ` [PATCH 09/20] x86/uaccess,kasan: Fix KASAN vs SMAP Peter Zijlstra
2019-03-07 11:45 ` [PATCH 10/20] x86/uaccess,ubsan: Fix UBSAN " Peter Zijlstra
2019-03-07 11:45 ` [PATCH 11/20] x86/uaccess,ftrace: Fix ftrace_likely_update() " Peter Zijlstra
2019-03-07 11:45 ` [PATCH 12/20] objtool: Set insn->func for alternatives Peter Zijlstra
2019-03-08 19:16   ` Josh Poimboeuf
2019-03-08 19:51     ` Peter Zijlstra
2019-03-07 11:45 ` [PATCH 13/20] objtool: Hande function aliases Peter Zijlstra
2019-03-08 19:23   ` Josh Poimboeuf
2019-03-08 19:52     ` Peter Zijlstra
2019-03-08 20:00       ` Josh Poimboeuf
2019-03-07 11:45 ` [PATCH 14/20] objtool: Rewrite add_ignores() Peter Zijlstra
2019-03-08 19:29   ` Josh Poimboeuf
2019-03-07 11:45 ` [PATCH 15/20] objtool: Add --backtrace support Peter Zijlstra
2019-03-08 19:33   ` Josh Poimboeuf
2019-03-07 11:45 ` [PATCH 16/20] objtool: Rewrite alt->skip_orig Peter Zijlstra
2019-03-08 20:15   ` Josh Poimboeuf
2019-03-08 21:34     ` Peter Zijlstra
2019-03-08 22:27       ` Josh Poimboeuf
2019-03-07 11:45 ` Peter Zijlstra [this message]
2019-03-08 20:22   ` [PATCH 17/20] objtool: Fix sibling call detection Josh Poimboeuf
2019-03-07 11:45 ` [PATCH 18/20] objtool: Add UACCESS validation Peter Zijlstra
2019-03-07 16:33   ` Linus Torvalds
2019-03-07 17:10     ` hpa
2019-03-07 17:41     ` Peter Zijlstra
2019-03-07 17:54       ` Linus Torvalds
2019-03-07 18:48         ` Peter Zijlstra
2019-03-07 18:51           ` hpa
2019-03-07 19:03           ` Peter Zijlstra
2019-03-08 15:01             ` Josh Poimboeuf
2019-03-08 15:07               ` Peter Zijlstra
2019-03-07 20:23           ` Peter Zijlstra
2019-03-07 20:40             ` Peter Zijlstra
2019-03-08 15:07               ` Josh Poimboeuf
2019-03-08 15:23                 ` Peter Zijlstra
2019-03-07 20:15       ` Andrey Ryabinin
2019-03-07 20:33         ` Peter Zijlstra
2019-03-07 20:40           ` Andrey Ryabinin
2019-03-07 20:42           ` Peter Zijlstra
2019-03-08 21:02   ` Josh Poimboeuf
2019-03-08 21:31     ` Peter Zijlstra
2019-03-08 21:54       ` Josh Poimboeuf
2019-03-10 13:10     ` Peter Zijlstra
2019-03-11 18:01       ` Josh Poimboeuf
2019-03-07 11:45 ` [PATCH 19/20] objtool: uaccess PUSHF/POPF support Peter Zijlstra
2019-03-08 21:11   ` Josh Poimboeuf
2019-03-10 13:12     ` Peter Zijlstra
2019-03-07 11:45 ` [PATCH 20/20] objtool: Add Direction Flag validation Peter Zijlstra
2019-03-08 21:16   ` Josh Poimboeuf
2019-03-08 21:33     ` Peter Zijlstra
2019-03-08 21:56       ` Josh Poimboeuf
2019-03-10 13:13         ` Peter Zijlstra
2019-03-11 18:00           ` Josh Poimboeuf
2019-03-07 12:03 ` [PATCH 00/20] objtool: UACCESS validation v3 Peter Zijlstra
2019-03-07 12:55   ` Peter Zijlstra
2019-03-07 13:13     ` Peter Zijlstra
2019-03-07 16:47       ` Josh Poimboeuf
2019-03-07 16:50         ` Josh Poimboeuf
2019-03-07 17:00         ` Linus Torvalds
2019-03-07 17:17           ` Josh Poimboeuf
2019-03-07 17:38             ` Peter Zijlstra
2019-03-07 17:45               ` Linus Torvalds
2019-03-07 18:18                 ` Steven Rostedt
2019-03-10 13:16                   ` Peter Zijlstra
2019-04-19 10:08                     ` [PATCH] compiler.h, tracing: Remove CONFIG_PROFILE_ALL_BRANCHES Ingo Molnar
2019-04-19 13:04                       ` Steven Rostedt
2019-03-07 17:04         ` [PATCH 00/20] objtool: UACCESS validation v3 hpa
2019-03-07 17:18           ` Josh Poimboeuf
2019-03-07 17:29             ` hpa
2019-03-07 17:45               ` Josh Poimboeuf
2019-03-07 17:48                 ` Linus Torvalds
2019-03-07 17:43         ` Peter Zijlstra
2019-03-07 17:48           ` Josh Poimboeuf
2019-04-03  8:21             ` [tip:core/objtool] tracing: Improve "if" macro code generation tip-bot for Josh Poimboeuf
2019-03-07 16:31   ` [PATCH 00/20] objtool: UACCESS validation v3 Linus Torvalds
2019-03-07 17:14 ` hpa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190307115200.605521081@infradead.org \
    --to=peterz@infradead.org \
    --cc=bp@alien8.de \
    --cc=brgerst@gmail.com \
    --cc=catalin.marinas@arm.com \
    --cc=dvlasenk@redhat.com \
    --cc=dvyukov@google.com \
    --cc=hpa@zytor.com \
    --cc=james.morse@arm.com \
    --cc=jpoimboe@redhat.com \
    --cc=julien.thierry@arm.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=luto@amacapital.net \
    --cc=luto@kernel.org \
    --cc=mingo@kernel.org \
    --cc=rostedt@goodmis.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=valentin.schneider@arm.com \
    --cc=will.deacon@arm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).