Skip to content
Permalink
Browse files
objtool: Add CONFIG_CFI_CLANG support
The upcoming CONFIG_CFI_CLANG support uses -fsanitize=cfi, the
non-canonical version of which hijacks function entry by changing
function relocation references to point to an intermediary jump table.

For example:

  Relocation section '.rela.discard.func_stack_frame_non_standard' at offset 0x37e018 contains 6 entries:
      Offset             Info             Type               Symbol's Value  Symbol's Name + Addend
  0000000000000000  0002944700000002 R_X86_64_PC32          00000000000023f0 do_suspend_lowlevel + 0
  0000000000000008  0003c11900000001 R_X86_64_64            0000000000000008 xen_cpuid$e69bc59f4fade3b6f2b579b3934137df.cfi_jt + 0
  0000000000000010  0003980900000001 R_X86_64_64            0000000000000060 machine_real_restart.cfi_jt + 0
  0000000000000018  0003962b00000001 R_X86_64_64            0000000000000e18 kretprobe_trampoline.cfi_jt + 0
  0000000000000020  000028f300000001 R_X86_64_64            0000000000000000 .rodata + 12
  0000000000000028  000349f400000001 R_X86_64_64            0000000000000018 __crash_kexec.cfi_jt + 0

  0000000000000060 <machine_real_restart.cfi_jt>:
    60: e9 00 00 00 00          jmpq   65 <machine_real_restart.cfi_jt+0x5>
                        61: R_X86_64_PLT32      machine_real_restart-0x4
    65: cc                      int3
    66: cc                      int3
    67: cc                      int3

This breaks objtool vmlinux validation in many ways, including static
call site detection and the STACK_FRAME_NON_STANDARD() macro.

Fix it by converting those relocations' symbol references back to their
original non-jump-table versions.  Note this doesn't change the actual
relocations in the object itself, it just changes objtool's view of
them.

Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
  • Loading branch information
jpoimboe authored and intel-lab-lkp committed Jan 15, 2021
1 parent f06729b commit 8bd968235f05d3e12d27c48feea19efdb7abeca6
Show file tree
Hide file tree
Showing 2 changed files with 29 additions and 1 deletion.
@@ -382,6 +382,11 @@ static int read_sections(struct elf *elf)
}
sec->len = sec->sh.sh_size;

/* Detect -fsanitize=cfi related sections */
if (!strcmp(sec->name, ".text.__cfi_check") ||
!strncmp(sec->name, ".text..L.cfi.jumptable", 22))
sec->cfi_jt = true;

list_add_tail(&sec->list, &elf->sections);
elf_hash_add(elf->section_hash, &sec->hash, sec->idx);
elf_hash_add(elf->section_name_hash, &sec->name_hash, str_hash(sec->name));
@@ -621,6 +626,29 @@ static int read_relocs(struct elf *elf)
return -1;
}

/*
* Deal with -fsanitize=cfi (CONFIG_CFI_CLANG), which
* hijacks function entry by arbitrarily changing a lot
* of relocation symbol references to refer to an
* intermediate jump table. Undo that conversion so
* objtool can make sense of things.
*/
if (reloc->sym->sec->cfi_jt) {
struct symbol *func, *sym;

if (sym->type == STT_SECTION)
sym = find_func_by_offset(sym->sec,
reloc->addend);
else
sym = reloc->sym;

if (find_unsuffixed_func(elf, sym, ".cfi_jt", &func))
return -1;

if (func)
reloc->sym = func;
}

elf_add_reloc(elf, reloc);
nr_reloc++;
}
@@ -39,7 +39,7 @@ struct section {
char *name;
int idx;
unsigned int len;
bool changed, text, rodata, noinstr;
bool changed, text, rodata, noinstr, cfi_jt;
};

struct symbol {

0 comments on commit 8bd9682

Please sign in to comment.