linux-hardening - Re: [BUG] missing return thunk: __ret+0x5/0x7e-_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 26 Aug 2023 13:24:33 +0200
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Josh Poimboeuf <jpoimboe@...nel.org>
Cc:     Borislav Petkov <bp@...en8.de>,
        "Paul E. McKenney" <paulmck@...nel.org>,
        linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org,
        x86@...nel.org, peterz@...radead.org, keescook@...omium.org,
        elver@...gle.com, dvyukov@...gle.com, glider@...gle.com
Subject: Re: [BUG] missing return thunk: __ret+0x5/0x7e-__ret+0x0/0x7e: e9 f6
 ff ff ff

On Fri, Aug 25, 2023 at 04:26:57PM -0700, Josh Poimboeuf wrote:
> On Thu, Aug 24, 2023 at 03:52:56PM +0200, Greg KH wrote:
> > On Wed, Aug 16, 2023 at 08:17:20PM +0200, Borislav Petkov wrote:
> > > Hey Paul,
> > > 
> > > On Wed, Aug 16, 2023 at 10:54:09AM -0700, Paul E. McKenney wrote:
> > > > I hit the splat at the end of this message in recent mainline, and has
> > > > appeared some time since v6.5-rc1.  Should I be worried?
> > > 
> > > does it go away if you try the latest tip:x86/urgent branch?
> > 
> > Note, this problem is showing up in the 6.1.y branch right now, due to
> > one objtool patch not being able to be backported there easily (i.e. I
> > tried and gave up.)
> > 
> > 4ae68b26c3ab ("objtool/x86: Fix SRSO mess") being the commit that I
> > can't seem to get to work properly, my attempt can be seen here:
> > 	https://lore.kernel.org/r/2023082212-pregnant-lizard-80e0@gregkh
> 
> > --- a/tools/objtool/arch/x86/decode.c
> > +++ b/tools/objtool/arch/x86/decode.c
> > @@ -796,8 +796,11 @@ bool arch_is_retpoline(struct symbol *sy
> >  
> >  bool arch_is_rethunk(struct symbol *sym)
> >  {
> > -	return !strcmp(sym->name, "__x86_return_thunk") ||
> > -	       !strcmp(sym->name, "srso_untrain_ret") ||
> > -	       !strcmp(sym->name, "srso_safe_ret") ||
> > -	       !strcmp(sym->name, "retbleed_return_thunk");
> > +	return !strcmp(sym->name, "__x86_return_thunk");
> > +}
> > +
> > +bool arch_is_embedded_insn(struct symbol *sym)
> > +{
> > +	return !strcmp(sym->name, "retbleed_return_thunk") ||
> > +	       !strcmp(sym->name, "srso_safe_ret");
> 
> This wouldn't work with the current 6.1.y branch, I assume you had some
> other patches applied before this.  e.g., the patch renaming __ret to
> retbleed_return_thunk.

Yes, I did.

> >  }
> > --- a/tools/objtool/check.c
> > +++ b/tools/objtool/check.c
> > @@ -418,7 +418,7 @@ static int decode_instructions(struct ob
> >  		}
> >  
> >  		list_for_each_entry(func, &sec->symbol_list, list) {
> > -			if (func->type != STT_FUNC || func->alias != func)
> > +			if (func->embedded_insn || func->alias != func)
> >  				continue;
> 
> This hunk looks like a bug.  This might be the source of your problems.

Ah, I guessed wrong on that change, my fault :(

> The below patch seems to work on stock 6.1.47.  Or if you have other
> SRSO patches pending, point me to them and I can look at porting this
> one to fit.

I got this to apply on top of the latest series (-rc) and it passes
test-builds here.  I'll do a release now without it and then queue this
up, along with some other fixes for reported problems in previous
releases, and release it so that the CI systems can go at it.

Many thanks for this!

greg k-h