From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 49034C7618F for ; Mon, 15 Jul 2019 17:29:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1B548206B8 for ; Mon, 15 Jul 2019 17:29:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731723AbfGOR3i (ORCPT ); Mon, 15 Jul 2019 13:29:38 -0400 Received: from mx1.redhat.com ([209.132.183.28]:51708 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730774AbfGOR3h (ORCPT ); Mon, 15 Jul 2019 13:29:37 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id ED72A4E93D; Mon, 15 Jul 2019 17:29:36 +0000 (UTC) Received: from treble (ovpn-120-170.rdu2.redhat.com [10.10.120.170]) by smtp.corp.redhat.com (Postfix) with ESMTPS id F1DDB1001925; Mon, 15 Jul 2019 17:29:35 +0000 (UTC) Date: Mon, 15 Jul 2019 12:29:34 -0500 From: Josh Poimboeuf To: Nick Desaulniers Cc: "maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)" , LKML , Peter Zijlstra , Thomas Gleixner , Arnd Bergmann , Jann Horn , Randy Dunlap Subject: Re: [PATCH 20/22] objtool: Fix seg fault on bad switch table entry Message-ID: <20190715172934.4uinmu3ba65vcphv@treble> References: <9f67aa11794e9eebe5a3249529d1ecf60abf370f.1563150885.git.jpoimboe@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20180716 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Mon, 15 Jul 2019 17:29:37 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Jul 15, 2019 at 10:24:24AM -0700, Nick Desaulniers wrote: > On Sun, Jul 14, 2019 at 5:37 PM Josh Poimboeuf wrote: > > > > In one rare case, Clang generated the following code: > > > > 5ca: 83 e0 21 and $0x21,%eax > > 5cd: b9 04 00 00 00 mov $0x4,%ecx > > 5d2: ff 24 c5 00 00 00 00 jmpq *0x0(,%rax,8) > > 5d5: R_X86_64_32S .rodata+0x38 > > > > which uses the corresponding jump table relocations: > > > > 000000000038 000200000001 R_X86_64_64 0000000000000000 .text + 834 > > 000000000040 000200000001 R_X86_64_64 0000000000000000 .text + 5d9 > > 000000000048 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000050 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000058 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000060 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000068 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000070 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000078 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000080 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000088 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000090 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000098 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000a0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000a8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000b0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000b8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000c0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000c8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000d0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000d8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000e0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000e8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000f0 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 0000000000f8 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000100 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000108 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000110 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000118 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000120 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000128 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000130 000200000001 R_X86_64_64 0000000000000000 .text + b96 > > 000000000138 000200000001 R_X86_64_64 0000000000000000 .text + 82f > > 000000000140 000200000001 R_X86_64_64 0000000000000000 .text + 828 > > > > Since %eax was masked with 0x21, only the first two and the last two > > entries are possible. > > > > Objtool doesn't actually emulate all the code, so it isn't smart enough > > to know that all the middle entries aren't reachable. They point to the > > NOP padding area after the end of the function, so objtool seg faulted > > when it tried to dereference a NULL insn->func. > > > > After this fix, objtool still gives an "unreachable" error because it > > stops reading the jump table when it encounters the bad addresses: > > > > /home/jpoimboe/objtool-tests/adm1275.o: warning: objtool: adm1275_probe()+0x828: unreachable instruction > > > > While the above code is technically correct, it's very wasteful of > > memory -- it uses 34 jump table entries when only 4 are needed. It's > > also not possible for objtool to validate this type of switch table > > because the unused entries point outside the function and objtool has no > > way of determining if that's intentional. Hopefully the Clang folks can > > fix it. > > So this came from > drivers/hwmon/pmbus/adm1275.c ? > Any special configuration? Arnd shared the config and the .o file here: https://lkml.kernel.org/r/CAK8P3a2beBPP+KX4zTfSfFPwo+7ksWZLqZzpP9BJ80iPecg3zA@mail.gmail.com I used Arnd's .o file for testing. -- Josh