All of lore.kernel.org
 help / color / mirror / Atom feed
From: Josh Poimboeuf <jpoimboe@redhat.com>
To: x86@kernel.org
Cc: linux-kernel@vger.kernel.org,
	Peter Zijlstra <peterz@infradead.org>,
	Sami Tolvanen <samitolvanen@google.com>,
	Sedat Dilek <sedat.dilek@gmail.com>,
	Kees Cook <keescook@chromium.org>,
	Nick Desaulniers <ndesaulniers@google.com>,
	clang-built-linux@googlegroups.com,
	Miroslav Benes <mbenes@suse.cz>
Subject: [PATCH v2 11/20] objtool: Add CONFIG_CFI_CLANG support
Date: Thu, 21 Jan 2021 15:29:27 -0600	[thread overview]
Message-ID: <d743f4b36e120c06506567a9f87a062ae03da47f.1611263462.git.jpoimboe@redhat.com> (raw)
In-Reply-To: <cover.1611263461.git.jpoimboe@redhat.com>

The upcoming CONFIG_CFI_CLANG support uses -fsanitize=cfi, the
non-canonical version of which hijacks function entry by changing
function relocation references to point to an intermediary jump table.

For example:

  Relocation section '.rela.discard.func_stack_frame_non_standard' at offset 0x37e018 contains 6 entries:
      Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
  0000000000000000  0002944700000002 R_X86_64_PC32          00000000000023f0 do_suspend_lowlevel + 0
  0000000000000008  0003c11900000001 R_X86_64_64            0000000000000008 xen_cpuid$e69bc59f4fade3b6f2b579b3934137df.cfi_jt + 0
  0000000000000010  0003980900000001 R_X86_64_64            0000000000000060 machine_real_restart.cfi_jt + 0
  0000000000000018  0003962b00000001 R_X86_64_64            0000000000000e18 kretprobe_trampoline.cfi_jt + 0
  0000000000000020  000028f300000001 R_X86_64_64            0000000000000000 .rodata + 12
  0000000000000028  000349f400000001 R_X86_64_64            0000000000000018 __crash_kexec.cfi_jt + 0

  0000000000000060 <machine_real_restart.cfi_jt>:
    60: e9 00 00 00 00          jmpq   65 <machine_real_restart.cfi_jt+0x5>
                        61: R_X86_64_PLT32      machine_real_restart-0x4
    65: cc                      int3
    66: cc                      int3
    67: cc                      int3

This breaks objtool vmlinux validation in many ways, including static
call site detection and the STACK_FRAME_NON_STANDARD() macro.

Fix it by converting those relocations' symbol references back to their
original non-jump-table versions.  Note this doesn't change the actual
relocations in the object itself, it just changes objtool's view of
them.

Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
---
 tools/objtool/elf.c                 | 28 ++++++++++++++++++++++++++++
 tools/objtool/include/objtool/elf.h |  2 +-
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c
index e7d9c29fe78c..18b6fc4ca1f8 100644
--- a/tools/objtool/elf.c
+++ b/tools/objtool/elf.c
@@ -382,6 +382,11 @@ static int read_sections(struct elf *elf)
 		}
 		sec->len = sec->sh.sh_size;
 
+		/* Detect -fsanitize=cfi related sections */
+		if (!strcmp(sec->name, ".text.__cfi_check") ||
+		    !strncmp(sec->name, ".text..L.cfi.jumptable", 22))
+			sec->cfi_jt = true;
+
 		list_add_tail(&sec->list, &elf->sections);
 		elf_hash_add(elf->section_hash, &sec->hash, sec->idx);
 		elf_hash_add(elf->section_name_hash, &sec->name_hash, str_hash(sec->name));
@@ -613,6 +618,29 @@ static int read_relocs(struct elf *elf)
 				return -1;
 			}
 
+			/*
+			 * Deal with -fsanitize=cfi (CONFIG_CFI_CLANG), which
+			 * hijacks function entry by arbitrarily changing a lot
+			 * of relocation symbol references to refer to an
+			 * intermediate jump table.  Undo that conversion so
+			 * objtool can make sense of things.
+			 */
+			if (reloc->sym->sec->cfi_jt) {
+				struct symbol *func, *sym;
+
+				if (reloc->sym->type == STT_SECTION)
+					sym = find_func_by_offset(reloc->sym->sec,
+								  reloc->addend);
+				else
+					sym = reloc->sym;
+
+				if (find_unsuffixed_func(elf, sym, ".cfi_jt", &func))
+					return -1;
+
+				if (func)
+					reloc->sym = func;
+			}
+
 			elf_add_reloc(elf, reloc);
 			nr_reloc++;
 		}
diff --git a/tools/objtool/include/objtool/elf.h b/tools/objtool/include/objtool/elf.h
index e6890cc70a25..bcc524d73f51 100644
--- a/tools/objtool/include/objtool/elf.h
+++ b/tools/objtool/include/objtool/elf.h
@@ -39,7 +39,7 @@ struct section {
 	char *name;
 	int idx;
 	unsigned int len;
-	bool changed, text, rodata, noinstr;
+	bool changed, text, rodata, noinstr, cfi_jt;
 };
 
 struct symbol {
-- 
2.29.2


  parent reply	other threads:[~2021-01-21 21:36 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-01-21 21:29 [PATCH v2 00/20] objtool: vmlinux.o and CLANG LTO support Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 01/20] objtool: Fix error handling for STD/CLD warnings Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 02/20] objtool: Fix retpoline detection in asm code Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 03/20] objtool: Fix ".cold" section suffix check for newer versions of GCC Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 04/20] objtool: Support retpoline jump detection for vmlinux.o Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 05/20] x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 06/20] objtool: Assume only ELF functions do sibling calls Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 07/20] objtool: Add asm version of STACK_FRAME_NON_STANDARD Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 08/20] objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 09/20] objtool: Add xen_start_kernel() to noreturn list Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 10/20] objtool: Move unsuffixed symbol conversion to a helper function Josh Poimboeuf
2021-01-21 21:29 ` Josh Poimboeuf [this message]
2021-01-21 21:29 ` [PATCH v2 12/20] x86/xen: Support objtool validation in xen-asm.S Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 13/20] x86/xen: Support objtool vmlinux.o validation in xen-head.S Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 14/20] x86/xen/pvh: Annotate indirect branch as safe Josh Poimboeuf
2021-01-22  5:17   ` Jürgen Groß
2021-01-21 21:29 ` [PATCH v2 15/20] x86/ftrace: Support objtool vmlinux.o validation in ftrace_64.S Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 16/20] x86/acpi: Annotate indirect branch as safe Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 17/20] x86/acpi: Support objtool validation in wakeup_64.S Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 18/20] x86/power: Annotate indirect branches as safe Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 19/20] x86/power: Move restore_registers() to top of the file Josh Poimboeuf
2021-01-21 21:29 ` [PATCH v2 20/20] x86/power: Support objtool validation in hibernate_asm_64.S Josh Poimboeuf
2021-01-21 22:38 ` [PATCH v2 00/20] objtool: vmlinux.o and CLANG LTO support Sedat Dilek
2021-01-22 15:41   ` Josh Poimboeuf
2021-01-22 21:17     ` Sami Tolvanen
2021-01-23  1:32       ` Nick Desaulniers
2021-01-23  2:26         ` Josh Poimboeuf
2021-01-23  2:31           ` Sedat Dilek
2021-01-23  2:46             ` Josh Poimboeuf
2021-01-23  2:50               ` Sedat Dilek
2021-01-25 22:43           ` Sami Tolvanen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=d743f4b36e120c06506567a9f87a062ae03da47f.1611263462.git.jpoimboe@redhat.com \
    --to=jpoimboe@redhat.com \
    --cc=clang-built-linux@googlegroups.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mbenes@suse.cz \
    --cc=ndesaulniers@google.com \
    --cc=peterz@infradead.org \
    --cc=samitolvanen@google.com \
    --cc=sedat.dilek@gmail.com \
    --cc=x86@kernel.org \
    --subject='Re: [PATCH v2 11/20] objtool: Add CONFIG_CFI_CLANG support' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.