From: Alexander Lobakin <alobakin@pm.me>
To: clang-built-linux@googlegroups.com, linux-mips@vger.kernel.org
Cc: Alexander Lobakin <alobakin@pm.me>,
Thomas Bogendoerfer <tsbogend@alpha.franken.de>,
Kees Cook <keescook@chromium.org>,
Nathan Chancellor <natechancellor@gmail.com>,
Nick Desaulniers <ndesaulniers@google.com>,
Fangrui Song <maskray@google.com>,
Sami Tolvanen <samitolvanen@google.com>,
Ralf Baechle <ralf@linux-mips.org>,
linux-kernel@vger.kernel.org, linux-arch@vger.kernel.org
Subject: [BUG mips llvm] MIPS: malformed R_MIPS_{HI16,LO16} with LLVM
Date: Sat, 09 Jan 2021 17:11:18 +0000 [thread overview]
Message-ID: <20210109171058.497636-1-alobakin@pm.me> (raw)
Machine: MIPS32 R2 Big Endian (interAptiv (multi))
While testing MIPS with LLVM, I found a weird and very rare bug with
MIPS relocs that LLVM emits into kernel modules. It happens on both
11.0.0 and latest git snapshot and applies, as I can see, only to
references to static symbols.
When the kernel loads the module, it allocates a space for every
section and then manually apply the relocations relative to the
new address.
Let's say we have a function phy_probe() in drivers/net/phy/libphy.ko.
It's static and referenced only in phy_register_driver(), where it's
used to fill callback pointer in a structure.
The real function address after module loading is 0xc06c1444, that
is observed in its ELF st_value field.
There are two relocs related to this usage in phy_register_driver():
R_MIPS_HI16 refers to 0x3c010000
R_MIPS_LO16 refers to 0x24339444
The address of .text is 0xc06b8000. So the destination is calculated
as follows:
0x00000000 from hi16;
0xffff9444 from lo16 (sign extend as it's always treated as signed);
0xc06b8000 from base.
= 0xc06b1444. The value is lower than the real phy_probe() address
(0xc06c1444) by 0x10000 and is lower than the base address of
module's .text, so it's 100% incorrect.
This results in:
[ 2.204022] CPU 3 Unable to handle kernel paging request at virtual
address c06b1444, epc == c06b1444, ra == 803f1090
The correct instructions should be:
R_MIPS_HI16 0x3c010001
R_MIPS_LO16 0x24339444
so there'll be 0x00010000 from hi16.
I tried to catch those bugs in arch/mips/kernel/module.c (by checking
if the destination is lower than the base address, which should never
happen), and seems like I have only 3 such places in libphy.ko (and
one in nf_tables.ko).
I don't think it should be handled somehow in mentioned source code
as it would look rather ugly and may break kernels build with GNU
stack, which seems to not produce such bad codes.
If I should report this to any other resources, please let me know.
I chose clang-built-linux and LKML as it may not happen with userland
(didn't tried to catch).
Thanks,
Al
next reply other threads:[~2021-01-09 17:12 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-01-09 17:11 Alexander Lobakin [this message]
2021-01-09 17:50 ` [BUG mips llvm] MIPS: malformed R_MIPS_{HI16,LO16} with LLVM Nick Desaulniers
2021-01-09 19:15 ` Alexander Lobakin
2021-01-09 23:29 ` Alexander Lobakin
2021-01-10 1:08 ` Alexander Lobakin
2021-01-11 20:03 ` Nick Desaulniers
2021-01-11 20:50 ` Alexander Lobakin
2021-01-12 22:14 ` Nick Desaulniers
2021-01-13 10:16 ` Alexander Lobakin
2021-05-07 7:47 ` Nathan Chancellor
2021-05-08 16:29 ` Alexander Lobakin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210109171058.497636-1-alobakin@pm.me \
--to=alobakin@pm.me \
--cc=clang-built-linux@googlegroups.com \
--cc=keescook@chromium.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mips@vger.kernel.org \
--cc=maskray@google.com \
--cc=natechancellor@gmail.com \
--cc=ndesaulniers@google.com \
--cc=ralf@linux-mips.org \
--cc=samitolvanen@google.com \
--cc=tsbogend@alpha.franken.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).