Skip to content

Commit 18f87c4

Browse files
ptalbertptalbert
committed
Merge: x86/retpoline: Fix Retbleed/SRSO security holes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6040 JIRA: https://issues.redhat.com/browse/RHEL-71467 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/6040 Omitted-fix: 4969d75 ("x86/vdso: Fix rethunk patching for vdso-image-x32.o too") Omitted-fix: b7bcffe ("x86/vdso/kbuild: Group non-standard build attributes and primary object file rules together") The first patch reverts RHEL only commit d0fd1f5 ("objtool: skip non-text sections when adding return-thunk sites") which is no longer needed. The remaining patches include commit 4461438 ("x86/retpoline: Ensure default return thunk isn't used at runtime") and its fixes to make sure that default return thunk is no longer being used. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Josh Poimboeuf <jpoimboe@redhat.com> Approved-by: Joe Lawrence <joe.lawrence@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: David Arcari <darcari@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: Patrick Talbert <ptalbert@redhat.com>
2 parents 5ba435c + 7456909 commit 18f87c4

File tree

9 files changed

+96
-71
lines changed

9 files changed

+96
-71
lines changed

‎arch/x86/entry/calling.h‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -426,3 +426,63 @@ For 32-bit we have the following conventions - kernel is built with
426426
.endm
427427

428428
#endif /* CONFIG_SMP */
429+
430+
#ifdef CONFIG_X86_64
431+
432+
/* rdi: arg1 ... normal C conventions. rax is saved/restored. */
433+
.macro THUNK name, func
434+
SYM_FUNC_START(\name)
435+
pushq %rbp
436+
movq %rsp, %rbp
437+
438+
pushq %rdi
439+
pushq %rsi
440+
pushq %rdx
441+
pushq %rcx
442+
pushq %rax
443+
pushq %r8
444+
pushq %r9
445+
pushq %r10
446+
pushq %r11
447+
448+
call \func
449+
450+
popq %r11
451+
popq %r10
452+
popq %r9
453+
popq %r8
454+
popq %rax
455+
popq %rcx
456+
popq %rdx
457+
popq %rsi
458+
popq %rdi
459+
popq %rbp
460+
RET
461+
SYM_FUNC_END(\name)
462+
_ASM_NOKPROBE(\name)
463+
.endm
464+
465+
#else /* CONFIG_X86_32 */
466+
467+
/* put return address in eax (arg1) */
468+
.macro THUNK name, func, put_ret_addr_in_eax=0
469+
SYM_CODE_START_NOALIGN(\name)
470+
pushl %eax
471+
pushl %ecx
472+
pushl %edx
473+
474+
.if \put_ret_addr_in_eax
475+
/* Place EIP in the arg1 */
476+
movl 3*4(%esp), %eax
477+
.endif
478+
479+
call \func
480+
popl %edx
481+
popl %ecx
482+
popl %eax
483+
RET
484+
_ASM_NOKPROBE(\name)
485+
SYM_CODE_END(\name)
486+
.endm
487+
488+
#endif

‎arch/x86/entry/entry.S‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,8 @@
1010
#include <asm/segment.h>
1111
#include <asm/cache.h>
1212

13+
#include "calling.h"
14+
1315
.pushsection .noinstr.text, "ax"
1416

1517
SYM_FUNC_START(entry_ibpb)
@@ -43,3 +45,4 @@ EXPORT_SYMBOL_GPL(mds_verw_sel);
4345

4446
.popsection
4547

48+
THUNK warn_thunk_thunk, __warn_thunk

‎arch/x86/entry/thunk_32.S‎

Lines changed: 8 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -4,33 +4,15 @@
44
* Copyright 2008 by Steven Rostedt, Red Hat, Inc
55
* (inspired by Andi Kleen's thunk_64.S)
66
*/
7-
#include <linux/linkage.h>
8-
#include <asm/asm.h>
9-
#include <asm/export.h>
107

11-
/* put return address in eax (arg1) */
12-
.macro THUNK name, func, put_ret_addr_in_eax=0
13-
SYM_CODE_START_NOALIGN(\name)
14-
pushl %eax
15-
pushl %ecx
16-
pushl %edx
8+
#include <linux/linkage.h>
9+
#include <asm/asm.h>
10+
#include <asm/export.h>
1711

18-
.if \put_ret_addr_in_eax
19-
/* Place EIP in the arg1 */
20-
movl 3*4(%esp), %eax
21-
.endif
12+
#include "calling.h"
2213

23-
call \func
24-
popl %edx
25-
popl %ecx
26-
popl %eax
27-
RET
28-
_ASM_NOKPROBE(\name)
29-
SYM_CODE_END(\name)
30-
.endm
31-
32-
THUNK preempt_schedule_thunk, preempt_schedule
33-
THUNK preempt_schedule_notrace_thunk, preempt_schedule_notrace
34-
EXPORT_SYMBOL(preempt_schedule_thunk)
35-
EXPORT_SYMBOL(preempt_schedule_notrace_thunk)
14+
THUNK preempt_schedule_thunk, preempt_schedule
15+
THUNK preempt_schedule_notrace_thunk, preempt_schedule_notrace
16+
EXPORT_SYMBOL(preempt_schedule_thunk)
17+
EXPORT_SYMBOL(preempt_schedule_notrace_thunk)
3618

‎arch/x86/entry/thunk_64.S‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -9,39 +9,6 @@
99
#include <asm/asm.h>
1010
#include <asm/export.h>
1111

12-
/* rdi: arg1 ... normal C conventions. rax is saved/restored. */
13-
.macro THUNK name, func
14-
SYM_FUNC_START(\name)
15-
pushq %rbp
16-
movq %rsp, %rbp
17-
18-
pushq %rdi
19-
pushq %rsi
20-
pushq %rdx
21-
pushq %rcx
22-
pushq %rax
23-
pushq %r8
24-
pushq %r9
25-
pushq %r10
26-
pushq %r11
27-
28-
call \func
29-
30-
popq %r11
31-
popq %r10
32-
popq %r9
33-
popq %r8
34-
popq %rax
35-
popq %rcx
36-
popq %rdx
37-
popq %rsi
38-
popq %rdi
39-
popq %rbp
40-
RET
41-
SYM_FUNC_END(\name)
42-
_ASM_NOKPROBE(\name)
43-
.endm
44-
4512
THUNK preempt_schedule_thunk, preempt_schedule
4613
THUNK preempt_schedule_notrace_thunk, preempt_schedule_notrace
4714
EXPORT_SYMBOL(preempt_schedule_thunk)

‎arch/x86/entry/vdso/Makefile‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -34,16 +34,19 @@ obj-y += vma.o extable.o
3434
KASAN_SANITIZE_vma.o := y
3535
UBSAN_SANITIZE_vma.o := y
3636
KCSAN_SANITIZE_vma.o := y
37-
OBJECT_FILES_NON_STANDARD_vma.o := n
38-
OBJECT_FILES_NON_STANDARD_extable.o := n
37+
38+
OBJECT_FILES_NON_STANDARD_extable.o := n
39+
OBJECT_FILES_NON_STANDARD_vdso-image-32.o := n
40+
OBJECT_FILES_NON_STANDARD_vdso-image-64.o := n
41+
OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n
42+
OBJECT_FILES_NON_STANDARD_vma.o := n
3943

4044
# vDSO images to build
4145
vdso_img-$(VDSO64-y) += 64
4246
vdso_img-$(VDSOX32-y) += x32
4347
vdso_img-$(VDSO32-y) += 32
4448

4549
obj-$(VDSO32-y) += vdso32-setup.o
46-
OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n
4750

4851
vobjs := $(foreach F,$(vobjs-y),$(obj)/$F)
4952
vobjs32 := $(foreach F,$(vobjs32-y),$(obj)/$F)

‎arch/x86/include/asm/nospec-branch.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -396,6 +396,8 @@ extern void clear_bhb_loop(void);
396396

397397
extern void (*x86_return_thunk)(void);
398398

399+
extern void __warn_thunk(void);
400+
399401
#ifdef CONFIG_MITIGATION_CALL_DEPTH_TRACKING
400402
extern void call_depth_return_thunk(void);
401403

‎arch/x86/kernel/cpu/bugs.c‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3102,3 +3102,8 @@ ssize_t cpu_show_reg_file_data_sampling(struct device *dev, struct device_attrib
31023102
return cpu_show_common(dev, attr, buf, X86_BUG_RFDS);
31033103
}
31043104
#endif
3105+
3106+
void __warn_thunk(void)
3107+
{
3108+
WARN_ONCE(1, "Unpatched return thunk in use. This should not happen!\n");
3109+
}

‎arch/x86/lib/retpoline.S‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -374,19 +374,23 @@ SYM_FUNC_END(call_depth_return_thunk)
374374
* 'JMP __x86_return_thunk' sites are changed to something else by
375375
* apply_returns().
376376
*
377-
* This should be converted eventually to call a warning function which
378-
* should scream loudly when the default return thunk is called after
379-
* alternatives have been applied.
380-
*
381-
* That warning function cannot BUG() because the bug splat cannot be
382-
* displayed in all possible configurations, leading to users not really
383-
* knowing why the machine froze.
377+
* The ALTERNATIVE below adds a really loud warning to catch the case
378+
* where the insufficient default return thunk ends up getting used for
379+
* whatever reason like miscompilation or failure of
380+
* objtool/alternatives/etc to patch all the return sites.
384381
*/
385382
SYM_CODE_START(__x86_return_thunk)
386383
UNWIND_HINT_FUNC
387384
ANNOTATE_NOENDBR
385+
#if defined(CONFIG_MITIGATION_UNRET_ENTRY) || \
386+
defined(CONFIG_MITIGATION_SRSO) || \
387+
defined(CONFIG_MITIGATION_CALL_DEPTH_TRACKING)
388+
ALTERNATIVE __stringify(ANNOTATE_UNRET_SAFE; ret), \
389+
"jmp warn_thunk_thunk", X86_FEATURE_ALWAYS
390+
#else
388391
ANNOTATE_UNRET_SAFE
389392
ret
393+
#endif
390394
int3
391395
SYM_CODE_END(__x86_return_thunk)
392396
EXPORT_SYMBOL(__x86_return_thunk)

‎tools/objtool/check.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1458,8 +1458,7 @@ static void add_return_call(struct objtool_file *file, struct instruction *insn,
14581458
insn->type = INSN_RETURN;
14591459
insn->retpoline_safe = true;
14601460

1461-
/* Skip the non-text sections, specially .discard ones */
1462-
if (add && insn->sec->text)
1461+
if (add)
14631462
list_add_tail(&insn->call_node, &file->return_thunk_list);
14641463
}
14651464

0 commit comments

Comments
 (0)