* [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
@ 2022-07-20 19:55 Steven Rostedt
2022-07-20 20:13 ` Kees Cook
0 siblings, 1 reply; 9+ messages in thread
From: Steven Rostedt @ 2022-07-20 19:55 UTC (permalink / raw)
To: LKML
Cc: Thomas Gleixner, x86, Linus Torvalds, Tim Chen, Josh Poimboeuf,
Andrew Cooper, Pawan Gupta, Johannes Wikner, Alyssa Milburn,
Jann Horn, H.J. Lu, Joao Moreira, Joseph Nuzman, Juergen Gross,
Peter Zijlstra (Intel), Masami Hiramatsu, Alexei Starovoitov,
Daniel Borkmann, Kees Cook
From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
The rodata test checks if executable code in the .rodata section will not
execute. But this also means that fix ups that the return hook code does
will not be able to change this code at boot up, and this causes a
warning.
By removing the RETHOOK_CFLAGS from the compilation of the rodata function
makes it hidden from objtool and it will not add its return hook into the
.returns section. This keeps the fix up code from trying and failing on
modifying the rodata return call.
Link: https://lore.kernel.org/all/20220720125736.48164a14@gandalf.local.home/
Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
---
[ Note, my tests are still running with this, but it passed the test that
caused the failure, so I decided to post this now. ]
arch/x86/Makefile | 1 +
drivers/misc/lkdtm/Makefile | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 1f40dad30d50..2dd61d8594f4 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -25,6 +25,7 @@ endif
ifdef CONFIG_RETHUNK
RETHUNK_CFLAGS := -mfunction-return=thunk-extern
RETPOLINE_CFLAGS += $(RETHUNK_CFLAGS)
+export RETHUNK_CFLAGS
endif
export RETPOLINE_CFLAGS
diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
index 2e0aa74ac185..fd96ac1617f7 100644
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -16,7 +16,7 @@ lkdtm-$(CONFIG_PPC_64S_HASH_MMU) += powerpc.o
KASAN_SANITIZE_rodata.o := n
KASAN_SANITIZE_stackleak.o := n
KCOV_INSTRUMENT_rodata.o := n
-CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO)
+CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS)
OBJCOPYFLAGS :=
OBJCOPYFLAGS_rodata_objcopy.o := \
--
2.35.1
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-20 19:55 [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS Steven Rostedt
@ 2022-07-20 20:13 ` Kees Cook
2022-07-20 22:56 ` Josh Poimboeuf
0 siblings, 1 reply; 9+ messages in thread
From: Kees Cook @ 2022-07-20 20:13 UTC (permalink / raw)
To: Steven Rostedt
Cc: LKML, Thomas Gleixner, x86, Linus Torvalds, Tim Chen,
Josh Poimboeuf, Andrew Cooper, Pawan Gupta, Johannes Wikner,
Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira, Joseph Nuzman,
Juergen Gross, Peter Zijlstra (Intel), Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
>
> The rodata test checks if executable code in the .rodata section will not
> execute. But this also means that fix ups that the return hook code does
> will not be able to change this code at boot up, and this causes a
> warning.
>
> By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> makes it hidden from objtool and it will not add its return hook into the
> .returns section. This keeps the fix up code from trying and failing on
> modifying the rodata return call.
>
> Link: https://lore.kernel.org/all/20220720125736.48164a14@gandalf.local.home/
>
> Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Yeah, this matches a portion of what was suggested:
https://lore.kernel.org/lkml/20220713213133.455599-1-keescook@chromium.org/
But it still needed objtool fixes:
https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
Perhaps objtool has already had patches landed for this? (Otherwise the
patch you suggested would fail to build on x86 with rethunk support.)
-Kees
> ---
>
> [ Note, my tests are still running with this, but it passed the test that
> caused the failure, so I decided to post this now. ]
>
> arch/x86/Makefile | 1 +
> drivers/misc/lkdtm/Makefile | 2 +-
> 2 files changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> index 1f40dad30d50..2dd61d8594f4 100644
> --- a/arch/x86/Makefile
> +++ b/arch/x86/Makefile
> @@ -25,6 +25,7 @@ endif
> ifdef CONFIG_RETHUNK
> RETHUNK_CFLAGS := -mfunction-return=thunk-extern
> RETPOLINE_CFLAGS += $(RETHUNK_CFLAGS)
> +export RETHUNK_CFLAGS
> endif
>
> export RETPOLINE_CFLAGS
> diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
> index 2e0aa74ac185..fd96ac1617f7 100644
> --- a/drivers/misc/lkdtm/Makefile
> +++ b/drivers/misc/lkdtm/Makefile
> @@ -16,7 +16,7 @@ lkdtm-$(CONFIG_PPC_64S_HASH_MMU) += powerpc.o
> KASAN_SANITIZE_rodata.o := n
> KASAN_SANITIZE_stackleak.o := n
> KCOV_INSTRUMENT_rodata.o := n
> -CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO)
> +CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS)
>
> OBJCOPYFLAGS :=
> OBJCOPYFLAGS_rodata_objcopy.o := \
> --
> 2.35.1
>
--
Kees Cook
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-20 20:13 ` Kees Cook
@ 2022-07-20 22:56 ` Josh Poimboeuf
2022-07-20 22:58 ` Josh Poimboeuf
0 siblings, 1 reply; 9+ messages in thread
From: Josh Poimboeuf @ 2022-07-20 22:56 UTC (permalink / raw)
To: Kees Cook
Cc: Steven Rostedt, LKML, Thomas Gleixner, x86, Linus Torvalds,
Tim Chen, Andrew Cooper, Pawan Gupta, Johannes Wikner,
Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira, Joseph Nuzman,
Juergen Gross, Peter Zijlstra (Intel), Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Wed, Jul 20, 2022 at 01:13:05PM -0700, Kees Cook wrote:
> On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> > From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
> >
> > The rodata test checks if executable code in the .rodata section will not
> > execute. But this also means that fix ups that the return hook code does
> > will not be able to change this code at boot up, and this causes a
> > warning.
> >
> > By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> > makes it hidden from objtool and it will not add its return hook into the
> > .returns section. This keeps the fix up code from trying and failing on
> > modifying the rodata return call.
> >
> > Link: https://lore.kernel.org/all/20220720125736.48164a14@gandalf.local.home/
> >
> > Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
>
> Yeah, this matches a portion of what was suggested:
> https://lore.kernel.org/lkml/20220713213133.455599-1-keescook@chromium.org/
>
> But it still needed objtool fixes:
> https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
>
> Perhaps objtool has already had patches landed for this? (Otherwise the
> patch you suggested would fail to build on x86 with rethunk support.)
I send this patch out a few days ago, nobody picked it up yet:
https://lkml.kernel.org/lkml/8ec0039712f252693049c70ed3891d39a2357112.1658155446.git.jpoimboe@kernel.org
--
Josh
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-20 22:56 ` Josh Poimboeuf
@ 2022-07-20 22:58 ` Josh Poimboeuf
2022-07-21 3:06 ` Kees Cook
2022-07-21 8:47 ` Peter Zijlstra
0 siblings, 2 replies; 9+ messages in thread
From: Josh Poimboeuf @ 2022-07-20 22:58 UTC (permalink / raw)
To: Kees Cook
Cc: Steven Rostedt, LKML, Thomas Gleixner, x86, Linus Torvalds,
Tim Chen, Andrew Cooper, Pawan Gupta, Johannes Wikner,
Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira, Joseph Nuzman,
Juergen Gross, Peter Zijlstra (Intel), Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Wed, Jul 20, 2022 at 03:56:18PM -0700, Josh Poimboeuf wrote:
> On Wed, Jul 20, 2022 at 01:13:05PM -0700, Kees Cook wrote:
> > On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> > > From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
> > >
> > > The rodata test checks if executable code in the .rodata section will not
> > > execute. But this also means that fix ups that the return hook code does
> > > will not be able to change this code at boot up, and this causes a
> > > warning.
> > >
> > > By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> > > makes it hidden from objtool and it will not add its return hook into the
> > > .returns section. This keeps the fix up code from trying and failing on
> > > modifying the rodata return call.
> > >
> > > Link: https://lore.kernel.org/all/20220720125736.48164a14@gandalf.local.home/
> > >
> > > Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> > > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> >
> > Yeah, this matches a portion of what was suggested:
> > https://lore.kernel.org/lkml/20220713213133.455599-1-keescook@chromium.org/
> >
> > But it still needed objtool fixes:
> > https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
> >
> > Perhaps objtool has already had patches landed for this? (Otherwise the
> > patch you suggested would fail to build on x86 with rethunk support.)
>
> I send this patch out a few days ago, nobody picked it up yet:
>
> https://lkml.kernel.org/lkml/8ec0039712f252693049c70ed3891d39a2357112.1658155446.git.jpoimboe@kernel.org
Actually Peter said he grabbed it and is planning to push it to -tip
tomorrow.
--
Josh
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-20 22:58 ` Josh Poimboeuf
@ 2022-07-21 3:06 ` Kees Cook
2022-07-21 8:47 ` Peter Zijlstra
1 sibling, 0 replies; 9+ messages in thread
From: Kees Cook @ 2022-07-21 3:06 UTC (permalink / raw)
To: Josh Poimboeuf
Cc: Steven Rostedt, LKML, Thomas Gleixner, x86, Linus Torvalds,
Tim Chen, Andrew Cooper, Pawan Gupta, Johannes Wikner,
Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira, Joseph Nuzman,
Juergen Gross, Peter Zijlstra (Intel), Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> On Wed, Jul 20, 2022 at 03:56:18PM -0700, Josh Poimboeuf wrote:
> > On Wed, Jul 20, 2022 at 01:13:05PM -0700, Kees Cook wrote:
> > > On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> > > > From: "Steven Rostedt (Google)" <rostedt@goodmis.org>
> > > >
> > > > The rodata test checks if executable code in the .rodata section will not
> > > > execute. But this also means that fix ups that the return hook code does
> > > > will not be able to change this code at boot up, and this causes a
> > > > warning.
> > > >
> > > > By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> > > > makes it hidden from objtool and it will not add its return hook into the
> > > > .returns section. This keeps the fix up code from trying and failing on
> > > > modifying the rodata return call.
> > > >
> > > > Link: https://lore.kernel.org/all/20220720125736.48164a14@gandalf.local.home/
> > > >
> > > > Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> > > > Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
> > >
> > > Yeah, this matches a portion of what was suggested:
> > > https://lore.kernel.org/lkml/20220713213133.455599-1-keescook@chromium.org/
> > >
> > > But it still needed objtool fixes:
> > > https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
> > >
> > > Perhaps objtool has already had patches landed for this? (Otherwise the
> > > patch you suggested would fail to build on x86 with rethunk support.)
> >
> > I send this patch out a few days ago, nobody picked it up yet:
> >
> > https://lkml.kernel.org/lkml/8ec0039712f252693049c70ed3891d39a2357112.1658155446.git.jpoimboe@kernel.org
>
> Actually Peter said he grabbed it and is planning to push it to -tip
> tomorrow.
Ah perfect; thank you!
--
Kees Cook
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-20 22:58 ` Josh Poimboeuf
2022-07-21 3:06 ` Kees Cook
@ 2022-07-21 8:47 ` Peter Zijlstra
2022-07-21 13:51 ` Steven Rostedt
1 sibling, 1 reply; 9+ messages in thread
From: Peter Zijlstra @ 2022-07-21 8:47 UTC (permalink / raw)
To: Josh Poimboeuf
Cc: Kees Cook, Steven Rostedt, LKML, Thomas Gleixner, x86,
Linus Torvalds, Tim Chen, Andrew Cooper, Pawan Gupta,
Johannes Wikner, Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira,
Joseph Nuzman, Juergen Gross, Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> Actually Peter said he grabbed it and is planning to push it to -tip
> tomorrow.
Robots were happy, all pushed now.
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-21 8:47 ` Peter Zijlstra
@ 2022-07-21 13:51 ` Steven Rostedt
2022-07-21 15:58 ` Peter Zijlstra
0 siblings, 1 reply; 9+ messages in thread
From: Steven Rostedt @ 2022-07-21 13:51 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Josh Poimboeuf, Kees Cook, LKML, Thomas Gleixner, x86,
Linus Torvalds, Tim Chen, Andrew Cooper, Pawan Gupta,
Johannes Wikner, Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira,
Joseph Nuzman, Juergen Gross, Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Thu, 21 Jul 2022 10:47:09 +0200
Peter Zijlstra <peterz@infradead.org> wrote:
> On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> > Actually Peter said he grabbed it and is planning to push it to -tip
> > tomorrow.
>
> Robots were happy, all pushed now.
What tree is this against. I tried to add it to v5.19-rc7 but it fails to
apply.
-- Steve
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-21 13:51 ` Steven Rostedt
@ 2022-07-21 15:58 ` Peter Zijlstra
2022-07-21 16:21 ` Steven Rostedt
0 siblings, 1 reply; 9+ messages in thread
From: Peter Zijlstra @ 2022-07-21 15:58 UTC (permalink / raw)
To: Steven Rostedt
Cc: Josh Poimboeuf, Kees Cook, LKML, Thomas Gleixner, x86,
Linus Torvalds, Tim Chen, Andrew Cooper, Pawan Gupta,
Johannes Wikner, Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira,
Joseph Nuzman, Juergen Gross, Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Thu, Jul 21, 2022 at 09:51:51AM -0400, Steven Rostedt wrote:
> On Thu, 21 Jul 2022 10:47:09 +0200
> Peter Zijlstra <peterz@infradead.org> wrote:
>
> > On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> > > Actually Peter said he grabbed it and is planning to push it to -tip
> > > tomorrow.
> >
> > Robots were happy, all pushed now.
>
> What tree is this against. I tried to add it to v5.19-rc7 but it fails to
> apply.
I can cleanly merge tip/x86/urgent into v5.19-rc7 (ff merge)
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS
2022-07-21 15:58 ` Peter Zijlstra
@ 2022-07-21 16:21 ` Steven Rostedt
0 siblings, 0 replies; 9+ messages in thread
From: Steven Rostedt @ 2022-07-21 16:21 UTC (permalink / raw)
To: Peter Zijlstra
Cc: Josh Poimboeuf, Kees Cook, LKML, Thomas Gleixner, x86,
Linus Torvalds, Tim Chen, Andrew Cooper, Pawan Gupta,
Johannes Wikner, Alyssa Milburn, Jann Horn, H.J. Lu, Joao Moreira,
Joseph Nuzman, Juergen Gross, Masami Hiramatsu,
Alexei Starovoitov, Daniel Borkmann
On Thu, 21 Jul 2022 17:58:13 +0200
Peter Zijlstra <peterz@infradead.org> wrote:
> > What tree is this against. I tried to add it to v5.19-rc7 but it fails to
> > apply.
>
> I can cleanly merge tip/x86/urgent into v5.19-rc7 (ff merge)
There's probably other commits in urgent that touch that code. I just
tried to apply the patch directly, because that's all I wanted to test.
-- Steve
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2022-07-21 16:21 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-20 19:55 [PATCH] lkdtm: Keep the rodata test from causing retbleed WARNINGS Steven Rostedt
2022-07-20 20:13 ` Kees Cook
2022-07-20 22:56 ` Josh Poimboeuf
2022-07-20 22:58 ` Josh Poimboeuf
2022-07-21 3:06 ` Kees Cook
2022-07-21 8:47 ` Peter Zijlstra
2022-07-21 13:51 ` Steven Rostedt
2022-07-21 15:58 ` Peter Zijlstra
2022-07-21 16:21 ` Steven Rostedt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox