linux-hardening - RE: [PATCH v2] ARM: unwind: improve unwinders for noreturn case

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 21 Mar 2024 10:22:30 +0000
From: David Laight <David.Laight@...LAB.COM>
To: 'Jiangfeng Xiao' <xiaojiangfeng@...wei.com>, "Russell King (Oracle)"
	<linux@...linux.org.uk>
CC: "arnd@...db.de" <arnd@...db.de>, "keescook@...omium.org"
	<keescook@...omium.org>, "haibo.li@...iatek.com" <haibo.li@...iatek.com>,
	"angelogioacchino.delregno@...labora.com"
	<angelogioacchino.delregno@...labora.com>, "amergnat@...libre.com"
	<amergnat@...libre.com>, "akpm@...ux-foundation.org"
	<akpm@...ux-foundation.org>, "dave.hansen@...ux.intel.com"
	<dave.hansen@...ux.intel.com>, "douzhaolei@...wei.com"
	<douzhaolei@...wei.com>, "gustavoars@...nel.org" <gustavoars@...nel.org>,
	"jpoimboe@...nel.org" <jpoimboe@...nel.org>, "kepler.chenxin@...wei.com"
	<kepler.chenxin@...wei.com>, "kirill.shutemov@...ux.intel.com"
	<kirill.shutemov@...ux.intel.com>, "linux-hardening@...r.kernel.org"
	<linux-hardening@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "linux-mm@...ck.org" <linux-mm@...ck.org>,
	"linux-arm-kernel@...ts.infradead.org"
	<linux-arm-kernel@...ts.infradead.org>, "nixiaoming@...wei.com"
	<nixiaoming@...wei.com>, "peterz@...radead.org" <peterz@...radead.org>,
	"wangbing6@...wei.com" <wangbing6@...wei.com>, "wangfangpeng1@...wei.com"
	<wangfangpeng1@...wei.com>, "jannh@...gle.com" <jannh@...gle.com>,
	"willy@...radead.org" <willy@...radead.org>
Subject: RE: [PATCH v2] ARM: unwind: improve unwinders for noreturn case

How aggressively does the compiler optimise 'noreturn' functions?
Consider:
void f(...)
{
	...
	if () {
		...
		noreturn(...);
	}
}

Without the noreturn() call it is a leaf function.
So the compiler doesn't need to save 'lr' on stack
(or the save could be deferred to inside the conditional).
Since noreturn() doesn't return it can be jumped to.
Additionally 'lr' can be used as a scratch register prior to
the noreturn() call.

So it is likely that inside noreturn() (and anything it
might call) you don't have a valid 'lr' chain at all.
No amount of picking between 'pc' and 'pc-1' is going to fix that.
The only way you can find a return address is by searching the
stack and hoping to find something that works.

So you need the compiler to 'not believe' the 'noreturn' attribute.
Setup a normal call frame and put a faulting instruction after the
call in case it returns.
That would give you half a chance of generating a backtrace.

Without that I suspect you are playing whack-a-mole.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)