[PATCH 01/11] objtool: Add support for intra-function calls
Juerg Haefliger
juerg.haefliger at canonical.com
Tue Apr 30 09:08:46 UTC 2024
On Wed, 17 Apr 2024 19:53:51 -0400
Yuxuan Luo <yuxuan.luo at canonical.com> wrote:
> From: Alexandre Chartre <alexandre.chartre at oracle.com>
>
> commit 8aa8eb2a8f5b3305a95f39957dd2b715fa668e21 upstream.
>
> Change objtool to support intra-function calls. On x86, an intra-function
> call is represented in objtool as a push onto the stack (of the return
> address), and a jump to the destination address. That way the stack
> information is correctly updated and the call flow is still accurate.
>
> Signed-off-by: Alexandre Chartre <alexandre.chartre at oracle.com>
> Signed-off-by: Peter Zijlstra (Intel) <peterz at infradead.org>
> Reviewed-by: Miroslav Benes <mbenes at suse.cz>
> Acked-by: Josh Poimboeuf <jpoimboe at redhat.com>
> Link: https://lkml.kernel.org/r/20200414103618.12657-4-alexandre.chartre@oracle.com
> Signed-off-by: Rui Qi <qirui.001 at bytedance.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
> (cherry picked from commit f8f25fde0cc680f6488aea6a0a1f80e689525e18
> stable/5.4.y)
> CVE-2024-2201
> Signed-off-by: Yuxuan Luo <yuxuan.luo at canonical.com>
Hm. Do we really need this? We've done mitigations in the past in old kernels
and just left out the annotations. See 4.19 an Cascardo's comment in:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=9f3330d4930e034d84ee6561fbfb098433ff0ab9
...Juerg
> ---
> include/linux/frame.h | 11 ++++
> .../Documentation/stack-validation.txt | 8 +++
> tools/objtool/arch/x86/decode.c | 6 ++
> tools/objtool/check.c | 62 +++++++++++++++++--
> 4 files changed, 83 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/frame.h b/include/linux/frame.h
> index 02d3ca2d95985..303cda600e56a 100644
> --- a/include/linux/frame.h
> +++ b/include/linux/frame.h
> @@ -15,9 +15,20 @@
> static void __used __section(.discard.func_stack_frame_non_standard) \
> *__func_stack_frame_non_standard_##func = func
>
> +/*
> + * This macro indicates that the following intra-function call is valid.
> + * Any non-annotated intra-function call will cause objtool to issue a warning.
> + */
> +#define ANNOTATE_INTRA_FUNCTION_CALL \
> + 999: \
> + .pushsection .discard.intra_function_calls; \
> + .long 999b; \
> + .popsection;
> +
> #else /* !CONFIG_STACK_VALIDATION */
>
> #define STACK_FRAME_NON_STANDARD(func)
> +#define ANNOTATE_INTRA_FUNCTION_CALL
>
> #endif /* CONFIG_STACK_VALIDATION */
>
> diff --git a/tools/objtool/Documentation/stack-validation.txt b/tools/objtool/Documentation/stack-validation.txt
> index de094670050be..ee26bb382b709 100644
> --- a/tools/objtool/Documentation/stack-validation.txt
> +++ b/tools/objtool/Documentation/stack-validation.txt
> @@ -290,6 +290,14 @@ they mean, and suggestions for how to fix them.
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=70646
>
>
> +11. file.o: warning: unannotated intra-function call
> +
> + This warning means that a direct call is done to a destination which
> + is not at the beginning of a function. If this is a legit call, you
> + can remove this warning by putting the ANNOTATE_INTRA_FUNCTION_CALL
> + directive right before the call.
> +
> +
> If the error doesn't seem to make sense, it could be a bug in objtool.
> Feel free to ask the objtool maintainer for help.
>
> diff --git a/tools/objtool/arch/x86/decode.c b/tools/objtool/arch/x86/decode.c
> index a62e032863a89..c3ff62c085c83 100644
> --- a/tools/objtool/arch/x86/decode.c
> +++ b/tools/objtool/arch/x86/decode.c
> @@ -437,6 +437,12 @@ int arch_decode_instruction(struct elf *elf, struct section *sec,
>
> case 0xe8:
> *type = INSN_CALL;
> + /*
> + * For the impact on the stack, a CALL behaves like
> + * a PUSH of an immediate value (the return address).
> + */
> + op->src.type = OP_SRC_CONST;
> + op->dest.type = OP_DEST_PUSH;
> break;
>
> case 0xfc:
> diff --git a/tools/objtool/check.c b/tools/objtool/check.c
> index dfd67243faac0..5165c2e0fb37d 100644
> --- a/tools/objtool/check.c
> +++ b/tools/objtool/check.c
> @@ -645,6 +645,7 @@ static int add_jump_destinations(struct objtool_file *file)
> return 0;
> }
>
> +
> /*
> * Find the destination instructions for all calls.
> */
> @@ -666,10 +667,7 @@ static int add_call_destinations(struct objtool_file *file)
> dest_off);
>
> if (!insn->call_dest && !insn->ignore) {
> - WARN_FUNC("unsupported intra-function call",
> - insn->sec, insn->offset);
> - if (retpoline)
> - WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE.");
> + WARN_FUNC("unannotated intra-function call", insn->sec, insn->offset);
> return -1;
> }
>
> @@ -1291,6 +1289,58 @@ static int read_retpoline_hints(struct objtool_file *file)
> return 0;
> }
>
> +
> +static int read_intra_function_calls(struct objtool_file *file)
> +{
> + struct instruction *insn;
> + struct section *sec;
> + struct rela *rela;
> +
> + sec = find_section_by_name(file->elf, ".rela.discard.intra_function_calls");
> + if (!sec)
> + return 0;
> +
> + list_for_each_entry(rela, &sec->rela_list, list) {
> + unsigned long dest_off;
> +
> + if (rela->sym->type != STT_SECTION) {
> + WARN("unexpected relocation symbol type in %s",
> + sec->name);
> + return -1;
> + }
> +
> + insn = find_insn(file, rela->sym->sec, rela->addend);
> + if (!insn) {
> + WARN("bad .discard.intra_function_call entry");
> + return -1;
> + }
> +
> + if (insn->type != INSN_CALL) {
> + WARN_FUNC("intra_function_call not a direct call",
> + insn->sec, insn->offset);
> + return -1;
> + }
> +
> + /*
> + * Treat intra-function CALLs as JMPs, but with a stack_op.
> + * See add_call_destinations(), which strips stack_ops from
> + * normal CALLs.
> + */
> + insn->type = INSN_JUMP_UNCONDITIONAL;
> +
> + dest_off = insn->offset + insn->len + insn->immediate;
> + insn->jump_dest = find_insn(file, insn->sec, dest_off);
> + if (!insn->jump_dest) {
> + WARN_FUNC("can't find call dest at %s+0x%lx",
> + insn->sec, insn->offset,
> + insn->sec->name, dest_off);
> + return -1;
> + }
> + }
> +
> + return 0;
> +}
> +
> static void mark_rodata(struct objtool_file *file)
> {
> struct section *sec;
> @@ -1346,6 +1396,10 @@ static int decode_sections(struct objtool_file *file)
> if (ret)
> return ret;
>
> + ret = read_intra_function_calls(file);
> + if (ret)
> + return ret;
> +
> ret = add_call_destinations(file);
> if (ret)
> return ret;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20240430/8321e343/attachment.sig>
More information about the kernel-team
mailing list