queue-6.8/x86-vdso-fix-rethunk-patching-for-vdso-image-32-64-..patch

   1 From 454f1055b2e80e8f94177e88d6178ba68682f669 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Mon, 19 Feb 2024 21:57:18 -0800
   4 Subject: x86/vdso: Fix rethunk patching for vdso-image-{32,64}.o
   5
   6 From: Josh Poimboeuf <jpoimboe@kernel.org>
   7
   8 [ Upstream commit b388e57d4628eb22782bdad4cd5b83ca87a1b7c9 ]
   9
  10 For CONFIG_RETHUNK kernels, objtool annotates all the function return
  11 sites so they can be patched during boot.  By design, after
  12 apply_returns() is called, all tail-calls to the compiler-generated
  13 default return thunk (__x86_return_thunk) should be patched out and
  14 replaced with whatever's needed for any mitigations (or lack thereof).
  15
  16 The commit
  17
  18   4461438a8405 ("x86/retpoline: Ensure default return thunk isn't used at runtime")
  19
  20 adds a runtime check and a WARN_ONCE() if the default return thunk ever
  21 gets executed after alternatives have been applied.  This warning is
  22 a sanity check to make sure objtool and apply_returns() are doing their
  23 job.
  24
  25 As Nathan reported, that check found something:
  26
  27   Unpatched return thunk in use. This should not happen!
  28   WARNING: CPU: 0 PID: 1 at arch/x86/kernel/cpu/bugs.c:2856 __warn_thunk+0x27/0x40
  29   RIP: 0010:__warn_thunk+0x27/0x40
  30   Call Trace:
  31    <TASK>
  32    ? show_regs
  33    ? __warn
  34    ? __warn_thunk
  35    ? report_bug
  36    ? console_unlock
  37    ? handle_bug
  38    ? exc_invalid_op
  39    ? asm_exc_invalid_op
  40    ? ia32_binfmt_init
  41    ? __warn_thunk
  42    warn_thunk_thunk
  43    do_one_initcall
  44    kernel_init_freeable
  45    ? __pfx_kernel_init
  46    kernel_init
  47    ret_from_fork
  48    ? __pfx_kernel_init
  49    ret_from_fork_asm
  50    </TASK>
  51
  52 Boris debugged to find that the unpatched return site was in
  53 init_vdso_image_64(), and its translation unit wasn't being analyzed by
  54 objtool, so it never got annotated.  So it got ignored by
  55 apply_returns().
  56
  57 This is only a minor issue, as this function is only called during boot.
  58 Still, objtool needs full visibility to the kernel.  Fix it by enabling
  59 objtool on vdso-image-{32,64}.o.
  60
  61 Note this problem can only be seen with !CONFIG_X86_KERNEL_IBT, as that
  62 requires objtool to run individually on all translation units rather on
  63 vmlinux.o.
  64
  65   [ bp: Massage commit message. ]
  66
  67 Reported-by: Nathan Chancellor <nathan@kernel.org>
  68 Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
  69 Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
  70 Link: https://lore.kernel.org/r/20240215032049.GA3944823@dev-arch.thelio-3990X
  71 Signed-off-by: Sasha Levin <sashal@kernel.org>
  72 ---
  73  arch/x86/entry/vdso/Makefile | 9 ++++++---
  74  1 file changed, 6 insertions(+), 3 deletions(-)
  75
  76 diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
  77 index b1b8dd1608f7e..4ee59121b9053 100644
  78 --- a/arch/x86/entry/vdso/Makefile
  79 +++ b/arch/x86/entry/vdso/Makefile
  80 @@ -34,8 +34,12 @@ obj-y                                        += vma.o extable.o
  81  KASAN_SANITIZE_vma.o                   := y
  82  UBSAN_SANITIZE_vma.o                   := y
  83  KCSAN_SANITIZE_vma.o                   := y
  84 -OBJECT_FILES_NON_STANDARD_vma.o                := n
  85 -OBJECT_FILES_NON_STANDARD_extable.o    := n
  86 +
  87 +OBJECT_FILES_NON_STANDARD_extable.o            := n
  88 +OBJECT_FILES_NON_STANDARD_vdso-image-32.o      := n
  89 +OBJECT_FILES_NON_STANDARD_vdso-image-64.o      := n
  90 +OBJECT_FILES_NON_STANDARD_vdso32-setup.o       := n
  91 +OBJECT_FILES_NON_STANDARD_vma.o                        := n
  92
  93  # vDSO images to build
  94  vdso_img-$(VDSO64-y)           += 64
  95 @@ -43,7 +47,6 @@ vdso_img-$(VDSOX32-y)         += x32
  96  vdso_img-$(VDSO32-y)           += 32
  97
  98  obj-$(VDSO32-y)                                 += vdso32-setup.o
  99 -OBJECT_FILES_NON_STANDARD_vdso32-setup.o := n
 100
 101  vobjs := $(foreach F,$(vobjs-y),$(obj)/$F)
 102  vobjs32 := $(foreach F,$(vobjs32-y),$(obj)/$F)
 103 --
 104 2.43.0
 105