From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751337AbdIBED6 (ORCPT ); Sat, 2 Sep 2017 00:03:58 -0400 Received: from mout.gmx.net ([212.227.15.18]:51514 "EHLO mout.gmx.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750935AbdIBEDz (ORCPT ); Sat, 2 Sep 2017 00:03:55 -0400 Message-ID: <1504324991.6011.7.camel@gmx.de> Subject: Re: [PATCH] locking/refcounts, x86/asm: Use unique .text section for refcount exceptions From: Mike Galbraith To: Kees Cook , Ingo Molnar Cc: x86@kernel.org, linux-arch@vger.kernel.org, linux-kernel@vger.kernel.org, "Reshetova, Elena" , Peter Zijlstra , Ard Biesheuvel Date: Sat, 02 Sep 2017 06:03:11 +0200 In-Reply-To: <20170901202203.GA48925@beast> References: <20170901202203.GA48925@beast> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.20.5 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit X-Provags-ID: V03:K0:ZYe7uYOKL2YTHFQz36DHLPFb57hBgvffj6BGkFn5v3s/XjAgi4y oKDpSaO9DmDL9RzsgBmJP1J8F1N15ktiZxKVXmgwa1e8mI7RyeaSuzXuxlAgzP5Iqr2/fim exFUAHuIUoymL+qWzzEkeof4O0554Me4P3duDPtAdvJrdV3ZOLt98wQ2wl9C+Zs/v/eDWX4 oVl3gGtk8B6R8hZ93LHzQ== X-UI-Out-Filterresults: notjunk:1;V01:K0:m6QpqvWLYUE=:UtCLvoa9hzoNslIa2FpppT XgzjSMjzfBGYU146ixROA1iG0CGmdAcJClk6shmT/zIBW+wyMbMWJoBN1a4zIBvoWh5dnSwic G+tH3yV4PTd+B6QqEfar+n/agVVVhWglehPXszq3rNpQ5KGYTg4l/lkCQopcSC52ni8LYfVt1 dX28S/fMWDjh3xT1gmW/DgxBaH5AyLpmhrcIxJnQV25m3cr7eB84iRqh7IE/9cL5riLJ/Yaag BBK99ZoN0irUXTuaEWmYHeG4QfKKQzcg+rTqvH2Con7nbsdyu4FQ/ba44gsLDjm6vZMczAg+V AUuOPXpLTeQdkSXfoQLz+egkYybfSGE5hbEB5LFz23bACCgZvELrBomcFq+TjRv/X6Lq0tsbo Qm39WFOUUuUqauM2+iKEvNOysRV8s9gv+dXRb+wSU50M2dhl+wLHBuzgvA/ris5eZB8ODcSWx blxkX7jUpbKS5kLKfFfwUGi4kA5t/UA5IL5z99mCRYN6goxFV74P5JhC16h7IQlWO7nr/rm/E QNx0I0DVjlKaA1Z+UhlkeJBfGPM2eJ/DAXT3Oxd9ZjYN9PsFL5C/tnmM+FPbGBnlXA7+YY2VD lu2oOLMUGlXBygHKqG7fCr2R/LA5rQjgwRmPGQ5DBJUoM1XePnPF05RmPCPCpj01mGn0Wc06g GV//7WnVjOM5aZJUJP++7yTFr7AallDtfkJxGyrIBbD33uiAG6X0NlvFX/A6RZqgxEYAdQaPP bzqCKms7VdgNkSuIqICj7RpZdGLBBFVvKpa0zZLM0FTYRIJBskaGuwAI7iasj/gK/mZzAy9Y7 wMpTapYX+S/g3FRYDrTn+4ieGCxMoTr9qShAObSCUh86tWbGWg= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2017-09-01 at 13:22 -0700, Kees Cook wrote: > Using .text.unlikely for refcount exceptions isn't safe because gcc may > move entire functions into .text.unlikely (e.g. in6_dev_get()), which > would cause any uses of a protected refcount_t function to stay inline > with the function, triggering the protection unconditionally: > > .section .text.unlikely,"ax",@progbits > .type in6_dev_get, @function > in6_dev_getx: > .LFB4673: > .loc 2 4128 0 > .cfi_startproc > ... > lock; incl 480(%rbx) > js 111f > .pushsection .text.unlikely > 111: lea 480(%rbx), %rcx > 112: .byte 0x0f, 0xff > .popsection > 113: > > This creates a unique .text section and adds an additional test to the > exception handler to WARN in the case of having none of OF, SF, nor ZF > set so we can see things like this more easily in the future. Closure: gcc-4.8.5 now builds a functional kernel as well, so that aspect of this bug was just a larger a dose of the same toxin. Question below. diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h > index ff871210b9f2..4e44250e7d0d 100644 > --- a/arch/x86/include/asm/refcount.h > +++ b/arch/x86/include/asm/refcount.h > @@ -15,7 +15,7 @@ > * back to the regular execution flow in .text. > */ > #define _REFCOUNT_EXCEPTION \ > - ".pushsection .text.unlikely\n" \ > + ".pushsection .text..refcount\n" \ Why two dots? (.text.refcount_ex?) -Mike