* [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation
@ 2019-05-06 7:20 Ingo Molnar
2019-05-06 7:24 ` hpa
2019-05-06 23:40 ` pr-tracker-bot
0 siblings, 2 replies; 3+ messages in thread
From: Ingo Molnar @ 2019-05-06 7:20 UTC (permalink / raw)
To: Linus Torvalds
Cc: linux-kernel, Peter Zijlstra, Thomas Gleixner, Borislav Petkov,
Andy Lutomirski, H. Peter Anvin, Andrew Morton
Linus,
Please pull the latest core-objtool-for-linus git tree from:
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core-objtool-for-linus
# HEAD: 29da93fea3ea39ab9b12270cc6be1b70ef201c9e mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
This is a series from Peter Zijlstra that adds x86 build-time uaccess
validation of SMAP to objtool, which will detect and warn about the
following uaccess API usage bugs and weirdnesses:
call to %s() with UACCESS enabled
return with UACCESS enabled
return with UACCESS disabled from a UACCESS-safe function
recursive UACCESS enable
redundant UACCESS disable
UACCESS-safe disables UACCESS
As it turns out not leaking uaccess permissions outside the intended
uaccess functionality is hard when the interfaces are complex and when
such bugs are mostly dormant.
As a bonus we now also check the DF flag. We had at least one
high-profile bug in that area in the early days of Linux, and the
checking is fairly simple. The checks performed and warnings emitted are:
call to %s() with DF set
return with DF set
return with modified stack frame
recursive STD
redundant CLD
It's all x86-only for now, but later on this can also be used for PAN on
ARM and objtool is fairly cross-platform in principle.
While all warnings emitted by this new checking facility that got
reported to us were fixed, there might be GCC version dependent warnings
that were not reported yet - which we'll address, should they trigger.
The warnings are non-fatal build warnings.
Thanks,
Ingo
------------------>
Josh Poimboeuf (1):
tracing: Improve "if" macro code generation
Peter Zijlstra (26):
sched/x86: Save [ER]FLAGS on context switch
x86/ia32: Fix ia32_restore_sigcontext() AC leak
i915, uaccess: Fix redundant CLAC
x86/uaccess: Move copy_user_handle_tail() into asm
x86/uaccess: Fix up the fixup
x86/nospec, objtool: Introduce ANNOTATE_IGNORE_ALTERNATIVE
x86/uaccess, xen: Suppress SMAP warnings
x86/uaccess: Always inline user_access_begin()
x86/uaccess, signal: Fix AC=1 bloat
x86/uaccess: Introduce user_access_{save,restore}()
x86/smap: Ditch __stringify()
x86/uaccess, kasan: Fix KASAN vs SMAP
x86/uaccess, ubsan: Fix UBSAN vs. SMAP
x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
x86/uaccess, kcov: Disable stack protector
objtool: Set insn->func for alternatives
objtool: Handle function aliases
objtool: Rewrite add_ignores()
objtool: Add --backtrace support
objtool: Rewrite alt->skip_orig
objtool: Fix sibling call detection
objtool: Add UACCESS validation
objtool: Add Direction Flag validation
sched/x86_64: Don't save flags on context switch
x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation
mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC versions
arch/x86/entry/entry_32.S | 2 +
arch/x86/ia32/ia32_signal.c | 29 ++-
arch/x86/include/asm/alternative-asm.h | 11 +
arch/x86/include/asm/alternative.h | 10 +
arch/x86/include/asm/asm.h | 24 --
arch/x86/include/asm/nospec-branch.h | 28 +-
arch/x86/include/asm/smap.h | 37 ++-
arch/x86/include/asm/switch_to.h | 1 +
arch/x86/include/asm/uaccess.h | 12 +-
arch/x86/include/asm/uaccess_64.h | 3 -
arch/x86/include/asm/xen/hypercall.h | 24 +-
arch/x86/kernel/process_32.c | 7 +
arch/x86/kernel/process_64.c | 1 +
arch/x86/kernel/signal.c | 29 ++-
arch/x86/lib/copy_user_64.S | 48 ++++
arch/x86/lib/memcpy_64.S | 3 +-
arch/x86/lib/usercopy_64.c | 20 --
drivers/gpu/drm/i915/i915_gem_execbuffer.c | 6 +-
include/linux/compiler.h | 2 +-
include/linux/uaccess.h | 2 +
kernel/Makefile | 1 +
kernel/trace/trace_branch.c | 4 +
lib/Makefile | 1 +
lib/strncpy_from_user.c | 5 +-
lib/strnlen_user.c | 4 +-
lib/ubsan.c | 4 +
mm/kasan/Makefile | 3 +
mm/kasan/common.c | 10 +
mm/kasan/report.c | 3 +-
scripts/Makefile.build | 3 +
tools/objtool/arch.h | 8 +-
tools/objtool/arch/x86/decode.c | 21 +-
tools/objtool/builtin-check.c | 4 +-
tools/objtool/builtin.h | 2 +-
tools/objtool/check.c | 400 ++++++++++++++++++++++-------
tools/objtool/check.h | 4 +-
tools/objtool/elf.c | 15 +-
tools/objtool/elf.h | 3 +-
tools/objtool/special.c | 18 ++
tools/objtool/special.h | 1 +
tools/objtool/warn.h | 8 +
41 files changed, 602 insertions(+), 219 deletions(-)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation
2019-05-06 7:20 [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation Ingo Molnar
@ 2019-05-06 7:24 ` hpa
2019-05-06 23:40 ` pr-tracker-bot
1 sibling, 0 replies; 3+ messages in thread
From: hpa @ 2019-05-06 7:24 UTC (permalink / raw)
To: Ingo Molnar, Linus Torvalds
Cc: linux-kernel, Peter Zijlstra, Thomas Gleixner, Borislav Petkov,
Andy Lutomirski, Andrew Morton
On May 6, 2019 12:20:12 AM PDT, Ingo Molnar <mingo@kernel.org> wrote:
>Linus,
>
>Please pull the latest core-objtool-for-linus git tree from:
>
>git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git
>core-objtool-for-linus
>
># HEAD: 29da93fea3ea39ab9b12270cc6be1b70ef201c9e mm/uaccess: Use
>'unsigned long' to placate UBSAN warnings on older GCC versions
>
>This is a series from Peter Zijlstra that adds x86 build-time uaccess
>validation of SMAP to objtool, which will detect and warn about the
>following uaccess API usage bugs and weirdnesses:
>
> call to %s() with UACCESS enabled
> return with UACCESS enabled
> return with UACCESS disabled from a UACCESS-safe function
> recursive UACCESS enable
> redundant UACCESS disable
> UACCESS-safe disables UACCESS
>
>As it turns out not leaking uaccess permissions outside the intended
>uaccess functionality is hard when the interfaces are complex and when
>such bugs are mostly dormant.
>
>As a bonus we now also check the DF flag. We had at least one
>high-profile bug in that area in the early days of Linux, and the
>checking is fairly simple. The checks performed and warnings emitted
>are:
>
> call to %s() with DF set
> return with DF set
> return with modified stack frame
> recursive STD
> redundant CLD
>
>It's all x86-only for now, but later on this can also be used for PAN
>on
>ARM and objtool is fairly cross-platform in principle.
>
>While all warnings emitted by this new checking facility that got
>reported to us were fixed, there might be GCC version dependent
>warnings
>that were not reported yet - which we'll address, should they trigger.
>
>The warnings are non-fatal build warnings.
>
> Thanks,
>
> Ingo
>
>------------------>
>Josh Poimboeuf (1):
> tracing: Improve "if" macro code generation
>
>Peter Zijlstra (26):
> sched/x86: Save [ER]FLAGS on context switch
> x86/ia32: Fix ia32_restore_sigcontext() AC leak
> i915, uaccess: Fix redundant CLAC
> x86/uaccess: Move copy_user_handle_tail() into asm
> x86/uaccess: Fix up the fixup
> x86/nospec, objtool: Introduce ANNOTATE_IGNORE_ALTERNATIVE
> x86/uaccess, xen: Suppress SMAP warnings
> x86/uaccess: Always inline user_access_begin()
> x86/uaccess, signal: Fix AC=1 bloat
> x86/uaccess: Introduce user_access_{save,restore}()
> x86/smap: Ditch __stringify()
> x86/uaccess, kasan: Fix KASAN vs SMAP
> x86/uaccess, ubsan: Fix UBSAN vs. SMAP
> x86/uaccess, ftrace: Fix ftrace_likely_update() vs. SMAP
> x86/uaccess, kcov: Disable stack protector
> objtool: Set insn->func for alternatives
> objtool: Handle function aliases
> objtool: Rewrite add_ignores()
> objtool: Add --backtrace support
> objtool: Rewrite alt->skip_orig
> objtool: Fix sibling call detection
> objtool: Add UACCESS validation
> objtool: Add Direction Flag validation
> sched/x86_64: Don't save flags on context switch
>x86/uaccess: Dont leak the AC flag into __put_user() argument
>evaluation
>mm/uaccess: Use 'unsigned long' to placate UBSAN warnings on older GCC
>versions
>
>
> arch/x86/entry/entry_32.S | 2 +
> arch/x86/ia32/ia32_signal.c | 29 ++-
> arch/x86/include/asm/alternative-asm.h | 11 +
> arch/x86/include/asm/alternative.h | 10 +
> arch/x86/include/asm/asm.h | 24 --
> arch/x86/include/asm/nospec-branch.h | 28 +-
> arch/x86/include/asm/smap.h | 37 ++-
> arch/x86/include/asm/switch_to.h | 1 +
> arch/x86/include/asm/uaccess.h | 12 +-
> arch/x86/include/asm/uaccess_64.h | 3 -
> arch/x86/include/asm/xen/hypercall.h | 24 +-
> arch/x86/kernel/process_32.c | 7 +
> arch/x86/kernel/process_64.c | 1 +
> arch/x86/kernel/signal.c | 29 ++-
> arch/x86/lib/copy_user_64.S | 48 ++++
> arch/x86/lib/memcpy_64.S | 3 +-
> arch/x86/lib/usercopy_64.c | 20 --
> drivers/gpu/drm/i915/i915_gem_execbuffer.c | 6 +-
> include/linux/compiler.h | 2 +-
> include/linux/uaccess.h | 2 +
> kernel/Makefile | 1 +
> kernel/trace/trace_branch.c | 4 +
> lib/Makefile | 1 +
> lib/strncpy_from_user.c | 5 +-
> lib/strnlen_user.c | 4 +-
> lib/ubsan.c | 4 +
> mm/kasan/Makefile | 3 +
> mm/kasan/common.c | 10 +
> mm/kasan/report.c | 3 +-
> scripts/Makefile.build | 3 +
> tools/objtool/arch.h | 8 +-
> tools/objtool/arch/x86/decode.c | 21 +-
> tools/objtool/builtin-check.c | 4 +-
> tools/objtool/builtin.h | 2 +-
>tools/objtool/check.c | 400
>++++++++++++++++++++++-------
> tools/objtool/check.h | 4 +-
> tools/objtool/elf.c | 15 +-
> tools/objtool/elf.h | 3 +-
> tools/objtool/special.c | 18 ++
> tools/objtool/special.h | 1 +
> tools/objtool/warn.h | 8 +
> 41 files changed, 602 insertions(+), 219 deletions(-)
Superb work.
--
Sent from my Android device with K-9 Mail. Please excuse my brevity.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation
2019-05-06 7:20 [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation Ingo Molnar
2019-05-06 7:24 ` hpa
@ 2019-05-06 23:40 ` pr-tracker-bot
1 sibling, 0 replies; 3+ messages in thread
From: pr-tracker-bot @ 2019-05-06 23:40 UTC (permalink / raw)
To: Ingo Molnar
Cc: Linus Torvalds, linux-kernel, Peter Zijlstra, Thomas Gleixner,
Borislav Petkov, Andy Lutomirski, H. Peter Anvin, Andrew Morton
The pull request you sent on Mon, 6 May 2019 09:20:12 +0200:
> git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git core-objtool-for-linus
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/6ec62961e6de9506e8b8620dc19897d8cfd41c2e
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.wiki.kernel.org/userdoc/prtracker
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-05-06 23:42 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-05-06 7:20 [GIT PULL] objtool changes for v5.2: Add build-time uaccess permissions and DF validation Ingo Molnar
2019-05-06 7:24 ` hpa
2019-05-06 23:40 ` pr-tracker-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®