Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [PATCH] objtool: Fix infinite loop in for_offset_range()
From:   Randy Dunlap <rdunlap@infradead.org>
To:     Josh Poimboeuf <jpoimboe@redhat.com>, x86@kernel.org
Cc:     linux-kernel@vger.kernel.org,
        Peter Zijlstra <peterz@infradead.org>,
        Miroslav Benes <mbenes@suse.cz>,
        Julien Thierry <jthierry@redhat.com>
References: <02b719674b031800b61e33c30b2e823183627c19.1587842122.git.jpoimboe@redhat.com>
 <844c4770-5e33-d02c-32d9-200dc7bc4146@infradead.org>
Message-ID: <ef00c23a-294d-5fea-d7ab-7f2834ec9beb@infradead.org>
Date:   Sat, 25 Apr 2020 13:07:56 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.7.0
MIME-Version: 1.0
In-Reply-To: <844c4770-5e33-d02c-32d9-200dc7bc4146@infradead.org>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 4/25/20 1:04 PM, Randy Dunlap wrote:
> On 4/25/20 12:19 PM, Josh Poimboeuf wrote:
>> Randy reported that objtool got stuck in an infinite loop when
>> processing drivers/i2c/busses/i2c-parport.o.  It was caused by the
>> following code:
>>
>>   00000000000001fd <line_set>:
>>    1fd:	48 b8 00 00 00 00 00 	movabs $0x0,%rax
>>    204:	00 00 00
>>   			1ff: R_X86_64_64	.rodata-0x8
>>    207:	41 55                	push   %r13
>>    209:	41 89 f5             	mov    %esi,%r13d
>>    20c:	41 54                	push   %r12
>>    20e:	49 89 fc             	mov    %rdi,%r12
>>    211:	55                   	push   %rbp
>>    212:	48 89 d5             	mov    %rdx,%rbp
>>    215:	53                   	push   %rbx
>>    216:	0f b6 5a 01          	movzbl 0x1(%rdx),%ebx
>>    21a:	48 8d 34 dd 00 00 00 	lea    0x0(,%rbx,8),%rsi
>>    221:	00
>>   			21e: R_X86_64_32S	.rodata
>>    222:	48 89 f1             	mov    %rsi,%rcx
>>    225:	48 29 c1             	sub    %rax,%rcx
>>
>> find_jump_table() saw the .rodata reference and tried to find a jump
>> table associated with it (though there wasn't one).  The -0x8 rela
>> addend is unusual.  It caused find_jump_table() to send a negative
>> table_offset (unsigned 0xfffffffffffffff8) to find_rela_by_dest().
>>
>> The negative offset should have been harmless, but it actually threw
>> for_offset_range() for a loop... literally.  When the mask value got
>> incremented past the end value, it also wrapped to zero, causing the
>> loop exit condition to remain true forever.
>>
>> Prevent this scenario from happening by ensuring the incremented value
>> is always >= the starting value.
>>
>> Fixes: 74b873e49d92 ("objtool: Optimize find_rela_by_dest_range()")
>> Reported-by: Randy Dunlap <rdunlap@infradead.org>
>> Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
> 
> Hi Josh,
> 
> When applied to linux-next 20200414 (where it was reported) and using
> config-r2092, objtool still loops (I killed it after 6 minutes of CPU time).

Nope, scratch that. Operator error. Sorry.

> When applied to linux-next 20200424 and using the same config-r2092 file,
> objtool appears to terminate normally and the entire build does also.
> 
> Acked-by: Randy Dunlap <rdunlap@infradead.org>
> Tested-by: Randy Dunlap <rdunlap@infradead.org>
> 
> thanks.
> 
>> ---


-- 
~Randy