Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 7 Mar 2019 14:13:12 +0100
From:   Peter Zijlstra <peterz@infradead.org>
To:     torvalds@linux-foundation.org, tglx@linutronix.de, hpa@zytor.com,
        julien.thierry@arm.com, will.deacon@arm.com, luto@amacapital.net,
        mingo@kernel.org, catalin.marinas@arm.com, james.morse@arm.com,
        valentin.schneider@arm.com, brgerst@gmail.com, jpoimboe@redhat.com,
        luto@kernel.org, bp@alien8.de, dvlasenk@redhat.com
Cc:     linux-kernel@vger.kernel.org, dvyukov@google.com,
        rostedt@goodmis.org
Subject: Re: [PATCH 00/20] objtool: UACCESS validation v3
Message-ID: <20190307131312.GC32534@hirez.programming.kicks-ass.net>
References: <20190307114511.870090179@infradead.org>
 <20190307120317.GD32477@hirez.programming.kicks-ass.net>
 <20190307125526.GB32534@hirez.programming.kicks-ass.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20190307125526.GB32534@hirez.programming.kicks-ass.net>
User-Agent: Mutt/1.10.1 (2018-07-13)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Mar 07, 2019 at 01:55:26PM +0100, Peter Zijlstra wrote:
> On Thu, Mar 07, 2019 at 01:03:17PM +0100, Peter Zijlstra wrote:


> > 01be     20d3:  31 c0                   xor    %eax,%eax
> > 01c0     20d5:  4c 39 eb                cmp    %r13,%rbx
> > 01c3     20d8:  77 08                   ja     20e2 <__do_sys_waitid+0x1cd>

randconfig-build/kernel/exit.o: warning: objtool:   __do_sys_waitid()+0x1c3: (branch)

> > 01cd     20e2:	83 f0 01             	xor    $0x1,%eax
> > 01d0     20e5:	48 89 c2             	mov    %rax,%rdx
> > 01d3     20e8:	83 e2 01             	and    $0x1,%edx
> > 01d6     20eb:	48 83 c2 02          	add    $0x2,%rdx
> > 01da     20ef:	48 ff 04 d5 00 00 00 	incq   0x0(,%rdx,8)
> > 01e1     20f6:	00 
> > 01de 			20f3: R_X86_64_32S	_ftrace_branch+0x148
> > 01e2     20f7:	84 c0                	test   %al,%al
> > 01e4     20f9:	75 2d                	jne    2128 <__do_sys_waitid+0x213>
> 
> we do not take this branch and fall-through.

And that is the error, I think. We should've taken it and went to:

  return -EFAULT;

because:

 +1be	xor  %eax,%eax	eax=0
 +1cd   xor  $0x1,%eax	eax=1
 +1e2   test %al,%al	1&1==1 -> ZF=0
 +1e4   jnz

Is an unconditional code sequence, but there's no way objtool can do
that without becoming a full blown interpreter :/

> > 0213     2128:  49 c7 c7 f2 ff ff ff    mov    $0xfffffffffffffff2,%r15
> > ffffffffffffe0eb }
> > 021a     212f:  48 8d 65 d8             lea    -0x28(%rbp),%rsp
> > 021e     2133:  4c 89 f8                mov    %r15,%rax
> > 0221     2136:  5b                      pop    %rbx
> > 0222     2137:  41 5c                   pop    %r12
> > 0224     2139:  41 5d                   pop    %r13
> > 0226     213b:  41 5e                   pop    %r14
> > 0228     213d:  41 5f                   pop    %r15
> > 022a     213f:  5d                      pop    %rbp
> > 022b     2140:  c3                      retq