Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 24 May 2018 13:40:24 +0200
From: Petr Mladek <pmladek@...e.com>
To: Thomas Garnier <thgarnie@...gle.com>,
	Steven Rostedt <rostedt@...dmis.org>
Cc: Herbert Xu <herbert@...dor.apana.org.au>,
	"David S . Miller" <davem@...emloft.net>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>, "H . Peter Anvin" <hpa@...or.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Josh Poimboeuf <jpoimboe@...hat.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Philippe Ombredanne <pombredanne@...b.com>,
	Kate Stewart <kstewart@...uxfoundation.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Yonghong Song <yhs@...com>,
	Andrey Ryabinin <aryabinin@...tuozzo.com>,
	Kees Cook <keescook@...omium.org>,
	Tom Lendacky <thomas.lendacky@....com>,
	"Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>,
	Andy Lutomirski <luto@...nel.org>,
	Dominik Brodowski <linux@...inikbrodowski.net>,
	Borislav Petkov <bp@...en8.de>, Borislav Petkov <bp@...e.de>,
	"Rafael J . Wysocki" <rjw@...ysocki.net>,
	Len Brown <len.brown@...el.com>, Pavel Machek <pavel@....cz>,
	Juergen Gross <jgross@...e.com>, Alok Kataria <akataria@...are.com>,
	Jan Kiszka <jan.kiszka@...mens.com>, Tejun Heo <tj@...nel.org>,
	Christoph Lameter <cl@...ux.com>,
	Dennis Zhou <dennisszhou@...il.com>,
	Boris Ostrovsky <boris.ostrovsky@...cle.com>,
	Alexey Dobriyan <adobriyan@...il.com>,
	Masami Hiramatsu <mhiramat@...nel.org>,
	Cao jin <caoj.fnst@...fujitsu.com>,
	Francis Deslauriers <francis.deslauriers@...icios.com>,
	"Paul E . McKenney" <paulmck@...ux.vnet.ibm.com>,
	Nicolas Pitre <nicolas.pitre@...aro.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Randy Dunlap <rdunlap@...radead.org>,
	"Luis R . Rodriguez" <mcgrof@...nel.org>,
	Arnd Bergmann <arnd@...db.de>, Christopher Li <sparse@...isli.org>,
	Jason Baron <jbaron@...mai.com>,
	Mika Westerberg <mika.westerberg@...ux.intel.com>,
	Lukas Wunner <lukas@...ner.de>,
	Dou Liyang <douly.fnst@...fujitsu.com>,
	Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>,
	Masahiro Yamada <yamada.masahiro@...ionext.com>,
	Ingo Molnar <mingo@...nel.org>, Nicholas Piggin <npiggin@...il.com>,
	"H . J . Lu" <hjl.tools@...il.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Radim Krčmář <rkrcmar@...hat.com>,
	Joerg Roedel <joro@...tes.org>, David Woodhouse <dwmw@...zon.co.uk>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Rik van Riel <riel@...hat.com>,
	Jia Zhang <qianyue.zj@...baba-inc.com>,
	Ricardo Neri <ricardo.neri-calderon@...ux.intel.com>,
	Jonathan Corbet <corbet@....net>, Jan Beulich <JBeulich@...e.com>,
	Matthias Kaehlcke <mka@...omium.org>, Baoquan He <bhe@...hat.com>,
	Jan H . Schönherr <jschoenh@...zon.de>,
	Daniel Micay <danielmicay@...il.com>, x86@...nel.org,
	linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	linux-pm@...r.kernel.org, virtualization@...ts.linux-foundation.org,
	xen-devel@...ts.xenproject.org, linux-arch@...r.kernel.org,
	linux-sparse@...r.kernel.org, kvm@...r.kernel.org,
	linux-doc@...r.kernel.org, kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v3 21/27] x86/ftrace: Adapt function tracing for PIE
 support

On Wed 2018-05-23 12:54:15, Thomas Garnier wrote:
> When using -fPIE/PIC with function tracing, the compiler generates a
> call through the GOT (call *__fentry__@...PCREL). This instruction
> takes 6 bytes instead of 5 on the usual relative call.
> 
> If PIE is enabled, replace the 6th byte of the GOT call by a 1-byte nop
> so ftrace can handle the previous 5-bytes as before.
> 
> Position Independent Executable (PIE) support will allow to extended the
> KASLR randomization range below the -2G memory limit.
> 
> Signed-off-by: Thomas Garnier <thgarnie@...gle.com>
> ---
>  arch/x86/include/asm/ftrace.h   |  6 +++--
>  arch/x86/include/asm/sections.h |  4 ++++
>  arch/x86/kernel/ftrace.c        | 42 +++++++++++++++++++++++++++++++--
>  3 files changed, 48 insertions(+), 4 deletions(-)
> 
> diff --git a/arch/x86/include/asm/ftrace.h b/arch/x86/include/asm/ftrace.h
> index c18ed65287d5..8f2decce38d8 100644
> --- a/arch/x86/include/asm/ftrace.h
> +++ b/arch/x86/include/asm/ftrace.h
> @@ -25,9 +25,11 @@ extern void __fentry__(void);
>  static inline unsigned long ftrace_call_adjust(unsigned long addr)
>  {
>  	/*
> -	 * addr is the address of the mcount call instruction.
> -	 * recordmcount does the necessary offset calculation.
> +	 * addr is the address of the mcount call instruction. PIE has always a
> +	 * byte added to the start of the function.
>  	 */
> +	if (IS_ENABLED(CONFIG_X86_PIE))
> +		addr -= 1;

This seems to modify the address even for modules that are _not_ compiled with
PIE, see below.

>  	return addr;
>  }
>  
> diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
> index 01ebcb6f263e..73b3c30cb7a3 100644
> --- a/arch/x86/kernel/ftrace.c
> +++ b/arch/x86/kernel/ftrace.c
> @@ -135,6 +135,44 @@ ftrace_modify_code_direct(unsigned long ip, unsigned const char *old_code,
>  	return 0;
>  }
>  
> +/* Bytes before call GOT offset */
> +const unsigned char got_call_preinsn[] = { 0xff, 0x15 };
> +
> +static int
> +ftrace_modify_initial_code(unsigned long ip, unsigned const char *old_code,
> +			   unsigned const char *new_code)
> +{
> +	unsigned char replaced[MCOUNT_INSN_SIZE + 1];
> +
> +	ftrace_expected = old_code;
> +
> +	/*
> +	 * If PIE is not enabled or no GOT call was found, default to the
> +	 * original approach to code modification.
> +	 */
> +	if (!IS_ENABLED(CONFIG_X86_PIE) ||
> +	    probe_kernel_read(replaced, (void *)ip, sizeof(replaced)) ||
> +	    memcmp(replaced, got_call_preinsn, sizeof(got_call_preinsn)))
> +		return ftrace_modify_code_direct(ip, old_code, new_code);

And this looks like an attempt to handle modules compiled without
PIE. Does it works with the right ip in that case?

I wonder if a better solution would be to update
scripts/recordmcount.c to store the incremented location into the module.

IMPORTANT: I have only vague picture about how this all works. It is
possible that I am completely wrong. The code might be correct,
especially if you tested this situation.

Best Regards,
Petr

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.