From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-26.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, URIBL_BLOCKED,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5AB93C4160E for ; Thu, 18 Mar 2021 17:12:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3891B64F40 for ; Thu, 18 Mar 2021 17:12:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232287AbhCRRLh (ORCPT ); Thu, 18 Mar 2021 13:11:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33192 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232296AbhCRRLZ (ORCPT ); Thu, 18 Mar 2021 13:11:25 -0400 Received: from mail-yb1-xb49.google.com (mail-yb1-xb49.google.com [IPv6:2607:f8b0:4864:20::b49]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 83A54C06175F for ; Thu, 18 Mar 2021 10:11:25 -0700 (PDT) Received: by mail-yb1-xb49.google.com with SMTP id e129so9577573yba.3 for ; Thu, 18 Mar 2021 10:11:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:in-reply-to:message-id:mime-version:references:subject:from:to :cc; bh=D5aIIw6ZgnQjO2LtKhTG0SnhlhRc7naBZb5HRsoPMYM=; b=DJs3PpKGZT5abgDxmLr20bRHSgWSXko38GVppWq5gA7qETnUgw0bw1lS6eKo3WFfko eAOZfq1smTFvIJOqfLkfTgwT4IQsV0telQvn0vGMyfw2yLTgzy8zulsGkDko+Wr94eVd R9bvyDRw0x6920hAolwlIsKRpDU4dsmS/kGGsKqFSuew1E2FLbM4OYgfHXGESRlJlvO0 nm2nTQhXGxw/QP5qx+9mb8RX37C7kICUl3sUZfQnPG/LnLB/Yv5y6sC+sDSXnH4r5rMW v9Q1TPupu6griqvZD2j2qc0nAa5fRI/yinH70Q08aajflrVhE6iYA50ugnXHLsPdr6HX Sn+Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:in-reply-to:message-id:mime-version :references:subject:from:to:cc; bh=D5aIIw6ZgnQjO2LtKhTG0SnhlhRc7naBZb5HRsoPMYM=; b=dU1uXDFhwsLnDT3H3PTH3rLU7m7e9U968ADfrE3JD/Xo8cpDHgG2J4nFwIO+B9XdP5 1UvWERuk5+yKyR4P2F2aUwJhqFvNW8GYuC1n6fOLg/pDJeInRlK9BuwATL5Q/nnIXFV2 CxG+m2KkwTS2ZRBSrUYl1++rWjHiP/7/q7biHrdcCO+/SIRB4JIZRBR3etuYkuLwNUUj VlFEvKOLNT2pcWR41B9ymLdx+kKh2EEzPapZqt92ym5cvMiawADRqWMdC5cGDw7c0RS6 fRxF8J7WF72b1wK76uYhIYH+Lj/SdYIDHNn7OIoeiWHTRO5tE+FnvmDDfqndIZ57RRo6 XoiA== X-Gm-Message-State: AOAM530d6KRlGy3f5wEW4+C5s5PTYIVXwENhgtcEI+2EpZnNIV/rrAV2 ainoP5BUnA/L0NdO9qU1KaBXGCopltsjfnCGuCs= X-Google-Smtp-Source: ABdhPJyPBt6MH4faEqf0AYmhZmuTW6b6F0vtOC0nIFwVJkoD535hPrMSE+Vii/iaUNCDzOi8rgltoGh+k3M7Eul0cOI= X-Received: from samitolvanen1.mtv.corp.google.com ([2620:15c:201:2:c0d7:a7ba:fb41:a35a]) (user=samitolvanen job=sendgmr) by 2002:a25:804e:: with SMTP id a14mr496516ybn.206.1616087484769; Thu, 18 Mar 2021 10:11:24 -0700 (PDT) Date: Thu, 18 Mar 2021 10:10:58 -0700 In-Reply-To: <20210318171111.706303-1-samitolvanen@google.com> Message-Id: <20210318171111.706303-5-samitolvanen@google.com> Mime-Version: 1.0 References: <20210318171111.706303-1-samitolvanen@google.com> X-Mailer: git-send-email 2.31.0.291.g576ba9dcdaf-goog Subject: [PATCH v2 04/17] module: ensure __cfi_check alignment From: Sami Tolvanen To: Kees Cook Cc: Nathan Chancellor , Nick Desaulniers , Masahiro Yamada , Will Deacon , Jessica Yu , Arnd Bergmann , Tejun Heo , "Paul E. McKenney" , Christoph Hellwig , bpf@vger.kernel.org, linux-hardening@vger.kernel.org, linux-arch@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kbuild@vger.kernel.org, linux-pci@vger.kernel.org, linux-kernel@vger.kernel.org, Sami Tolvanen Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org CONFIG_CFI_CLANG_SHADOW assumes the __cfi_check() function is page aligned and at the beginning of the .text section. While Clang would normally align the function correctly, it fails to do so for modules with no executable code. This change ensures the correct __cfi_check() location and alignment. It also discards the .eh_frame section, which Clang can generate with certain sanitizers, such as CFI. Link: https://bugs.llvm.org/show_bug.cgi?id=46293 Signed-off-by: Sami Tolvanen --- scripts/module.lds.S | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/scripts/module.lds.S b/scripts/module.lds.S index 168cd27e6122..93518579cf5d 100644 --- a/scripts/module.lds.S +++ b/scripts/module.lds.S @@ -3,10 +3,19 @@ * Archs are free to supply their own linker scripts. ld will * combine them automatically. */ +#include + +#ifdef CONFIG_CFI_CLANG +# define ALIGN_CFI ALIGN(PAGE_SIZE) +#else +# define ALIGN_CFI +#endif + SECTIONS { /DISCARD/ : { *(.discard) *(.discard.*) + *(.eh_frame) } __ksymtab 0 : { *(SORT(___ksymtab+*)) } @@ -40,7 +49,14 @@ SECTIONS { *(.rodata..L*) } - .text : { *(.text .text.[0-9a-zA-Z_]*) } + /* + * With CONFIG_CFI_CLANG, we assume __cfi_check is at the beginning + * of the .text section, and is aligned to PAGE_SIZE. + */ + .text : ALIGN_CFI { + *(.text.__cfi_check) + *(.text .text.[0-9a-zA-Z_]* .text..L.cfi*) + } } /* bring in arch-specific sections */ -- 2.31.0.291.g576ba9dcdaf-goog