From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755653AbdGSTh0 (ORCPT ); Wed, 19 Jul 2017 15:37:26 -0400 Received: from mx1.redhat.com ([209.132.183.28]:56412 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751968AbdGSThX (ORCPT ); Wed, 19 Jul 2017 15:37:23 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 8C221C060202 Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx08.extmail.prod.ext.phx2.redhat.com; spf=pass smtp.mailfrom=jpoimboe@redhat.com DKIM-Filter: OpenDKIM Filter v2.11.0 mx1.redhat.com 8C221C060202 Date: Wed, 19 Jul 2017 14:37:18 -0500 From: Josh Poimboeuf To: Kees Cook Cc: Ingo Molnar , Peter Zijlstra , Christoph Hellwig , "Eric W. Biederman" , Andrew Morton , Jann Horn , Eric Biggers , Elena Reshetova , Hans Liljestrand , Greg KH , Alexey Dobriyan , "Serge E. Hallyn" , arozansk@redhat.com, Davidlohr Bueso , Manfred Spraul , "axboe@kernel.dk" , James Bottomley , "x86@kernel.org" , Arnd Bergmann , "David S. Miller" , Rik van Riel , linux-kernel@vger.kernel.org, linux-arch , "kernel-hardening@lists.openwall.com" Subject: Re: [PATCH v6 2/2] x86/refcount: Implement fast refcount overflow protection Message-ID: <20170719193718.bvkkde5apbboudrk@treble> References: <1500422614-94821-1-git-send-email-keescook@chromium.org> <1500422614-94821-3-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1500422614-94821-3-git-send-email-keescook@chromium.org> User-Agent: Mutt/1.6.0.1 (2016-04-01) X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.32]); Wed, 19 Jul 2017 19:37:23 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jul 18, 2017 at 05:03:34PM -0700, Kees Cook wrote: > +/* > + * Body of refcount error handling: in .text.unlikely, saved into CX the > + * address of the refcount that has entered a bad state, and trigger an > + * exception. Fixup address is back in regular execution flow in .text. > + */ > +#define _REFCOUNT_EXCEPTION \ > + ".pushsection .text.unlikely\n" \ > + "111:\tlea %[counter], %%" _ASM_CX "\n" \ > + "112:\t" ASM_UD0 "\n" \ > + ".popsection\n" \ > + "113:\n" \ > + _ASM_EXTABLE_REFCOUNT(112b, 113b) This confuses the freshly merged objtool 2.0, which is now too smart for its own good. It's reporting some errors like: >> kernel/sched/autogroup.o: warning: objtool: sched_autogroup_exit()+0x48: return with modified stack frame >> kernel/sched/autogroup.o: warning: objtool: .text.unlikely+0x27: stack state mismatch: reg1[3]=-2-40 reg2[3]=-2-24 >> kernel/sched/autogroup.o: warning: objtool: sched_autogroup_exit()+0x14: stack state mismatch: reg1[3]=-2-40 reg2[3]=-2-24 Because the UD instructions are used for both WARN and BUG, objtool doesn't know whether control flow continues past the instruction. So in cases like this, it needs an "unreachable" annotation. Here's a patch to fix it, feel free to squash it into yours: diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h index 13b91e850a02..e7587db3487c 100644 --- a/arch/x86/include/asm/refcount.h +++ b/arch/x86/include/asm/refcount.h @@ -15,6 +15,7 @@ ".pushsection .text.unlikely\n" \ "111:\tlea %[counter], %%" _ASM_CX "\n" \ "112:\t" ASM_UD0 "\n" \ + ASM_UNREACHABLE \ ".popsection\n" \ "113:\n" \ _ASM_EXTABLE_REFCOUNT(112b, 113b) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index cd4bbe8242bd..85e0b8f42ca0 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -202,15 +202,25 @@ #endif #ifdef CONFIG_STACK_VALIDATION + #define annotate_unreachable() ({ \ asm("%c0:\t\n" \ - ".pushsection .discard.unreachable\t\n" \ - ".long %c0b - .\t\n" \ - ".popsection\t\n" : : "i" (__LINE__)); \ + ".pushsection .discard.unreachable\n\t" \ + ".long %c0b - .\n\t" \ + ".popsection\n\t" : : "i" (__LINE__)); \ }) + +#define ASM_UNREACHABLE \ + "999: .pushsection .discard.unreachable\n\t" \ + ".long 999b - .\n\t" \ + ".popsection\n\t" + #else + #define annotate_unreachable() -#endif +#define ASM_UNREACHABLE + +#endif /* CONFIG_STACK_VALIDATION */ /* * Mark a position in code as unreachable. This can be used to