From: "Steven Rostedt (Google)" <[email protected]>
The rodata test checks if executable code in the .rodata section will not
execute. But this also means that fix ups that the return hook code does
will not be able to change this code at boot up, and this causes a
warning.
By removing the RETHOOK_CFLAGS from the compilation of the rodata function
makes it hidden from objtool and it will not add its return hook into the
.returns section. This keeps the fix up code from trying and failing on
modifying the rodata return call.
Link: https://lore.kernel.org/all/[email protected]/
Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
Signed-off-by: Steven Rostedt (Google) <[email protected]>
---
[ Note, my tests are still running with this, but it passed the test that
caused the failure, so I decided to post this now. ]
arch/x86/Makefile | 1 +
drivers/misc/lkdtm/Makefile | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 1f40dad30d50..2dd61d8594f4 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -25,6 +25,7 @@ endif
ifdef CONFIG_RETHUNK
RETHUNK_CFLAGS := -mfunction-return=thunk-extern
RETPOLINE_CFLAGS += $(RETHUNK_CFLAGS)
+export RETHUNK_CFLAGS
endif
export RETPOLINE_CFLAGS
diff --git a/drivers/misc/lkdtm/Makefile b/drivers/misc/lkdtm/Makefile
index 2e0aa74ac185..fd96ac1617f7 100644
--- a/drivers/misc/lkdtm/Makefile
+++ b/drivers/misc/lkdtm/Makefile
@@ -16,7 +16,7 @@ lkdtm-$(CONFIG_PPC_64S_HASH_MMU) += powerpc.o
KASAN_SANITIZE_rodata.o := n
KASAN_SANITIZE_stackleak.o := n
KCOV_INSTRUMENT_rodata.o := n
-CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO)
+CFLAGS_REMOVE_rodata.o += $(CC_FLAGS_LTO) $(RETHUNK_CFLAGS)
OBJCOPYFLAGS :=
OBJCOPYFLAGS_rodata_objcopy.o := \
--
2.35.1
On Wed, Jul 20, 2022 at 03:56:18PM -0700, Josh Poimboeuf wrote:
> On Wed, Jul 20, 2022 at 01:13:05PM -0700, Kees Cook wrote:
> > On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> > > From: "Steven Rostedt (Google)" <[email protected]>
> > >
> > > The rodata test checks if executable code in the .rodata section will not
> > > execute. But this also means that fix ups that the return hook code does
> > > will not be able to change this code at boot up, and this causes a
> > > warning.
> > >
> > > By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> > > makes it hidden from objtool and it will not add its return hook into the
> > > .returns section. This keeps the fix up code from trying and failing on
> > > modifying the rodata return call.
> > >
> > > Link: https://lore.kernel.org/all/[email protected]/
> > >
> > > Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> > > Signed-off-by: Steven Rostedt (Google) <[email protected]>
> >
> > Yeah, this matches a portion of what was suggested:
> > https://lore.kernel.org/lkml/[email protected]/
> >
> > But it still needed objtool fixes:
> > https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
> >
> > Perhaps objtool has already had patches landed for this? (Otherwise the
> > patch you suggested would fail to build on x86 with rethunk support.)
>
> I send this patch out a few days ago, nobody picked it up yet:
>
> https://lkml.kernel.org/lkml/8ec0039712f252693049c70ed3891d39a2357112.1658155446.git.jpoimboe@kernel.org
Actually Peter said he grabbed it and is planning to push it to -tip
tomorrow.
--
Josh
On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> On Wed, Jul 20, 2022 at 03:56:18PM -0700, Josh Poimboeuf wrote:
> > On Wed, Jul 20, 2022 at 01:13:05PM -0700, Kees Cook wrote:
> > > On Wed, Jul 20, 2022 at 03:55:07PM -0400, Steven Rostedt wrote:
> > > > From: "Steven Rostedt (Google)" <[email protected]>
> > > >
> > > > The rodata test checks if executable code in the .rodata section will not
> > > > execute. But this also means that fix ups that the return hook code does
> > > > will not be able to change this code at boot up, and this causes a
> > > > warning.
> > > >
> > > > By removing the RETHOOK_CFLAGS from the compilation of the rodata function
> > > > makes it hidden from objtool and it will not add its return hook into the
> > > > .returns section. This keeps the fix up code from trying and failing on
> > > > modifying the rodata return call.
> > > >
> > > > Link: https://lore.kernel.org/all/[email protected]/
> > > >
> > > > Fixes: ee88d363d1561 ("x86,static_call: Use alternative RET encoding")
> > > > Signed-off-by: Steven Rostedt (Google) <[email protected]>
> > >
> > > Yeah, this matches a portion of what was suggested:
> > > https://lore.kernel.org/lkml/[email protected]/
> > >
> > > But it still needed objtool fixes:
> > > https://lore.kernel.org/lkml/20220715032333.neywlazczbb35w3b@treble/
> > >
> > > Perhaps objtool has already had patches landed for this? (Otherwise the
> > > patch you suggested would fail to build on x86 with rethunk support.)
> >
> > I send this patch out a few days ago, nobody picked it up yet:
> >
> > https://lkml.kernel.org/lkml/8ec0039712f252693049c70ed3891d39a2357112.1658155446.git.jpoimboe@kernel.org
>
> Actually Peter said he grabbed it and is planning to push it to -tip
> tomorrow.
Ah perfect; thank you!
--
Kees Cook
On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> Actually Peter said he grabbed it and is planning to push it to -tip
> tomorrow.
Robots were happy, all pushed now.
On Thu, 21 Jul 2022 10:47:09 +0200
Peter Zijlstra <[email protected]> wrote:
> On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> > Actually Peter said he grabbed it and is planning to push it to -tip
> > tomorrow.
>
> Robots were happy, all pushed now.
What tree is this against. I tried to add it to v5.19-rc7 but it fails to
apply.
-- Steve
On Thu, Jul 21, 2022 at 09:51:51AM -0400, Steven Rostedt wrote:
> On Thu, 21 Jul 2022 10:47:09 +0200
> Peter Zijlstra <[email protected]> wrote:
>
> > On Wed, Jul 20, 2022 at 03:58:09PM -0700, Josh Poimboeuf wrote:
> > > Actually Peter said he grabbed it and is planning to push it to -tip
> > > tomorrow.
> >
> > Robots were happy, all pushed now.
>
> What tree is this against. I tried to add it to v5.19-rc7 but it fails to
> apply.
I can cleanly merge tip/x86/urgent into v5.19-rc7 (ff merge)
On Thu, 21 Jul 2022 17:58:13 +0200
Peter Zijlstra <[email protected]> wrote:
> > What tree is this against. I tried to add it to v5.19-rc7 but it fails to
> > apply.
>
> I can cleanly merge tip/x86/urgent into v5.19-rc7 (ff merge)
There's probably other commits in urgent that touch that code. I just
tried to apply the patch directly, because that's all I wanted to test.
-- Steve