[PATCH 0/3] Support intra-function call validation

Rui Qi posted 3 patches 1 year, 11 months ago
There is a newer version of this series
arch/x86/include/asm/nospec-branch.h          |  7 ++
include/linux/frame.h                         | 11 ++++
.../Documentation/stack-validation.txt        |  8 +++
tools/objtool/arch/x86/decode.c               |  6 ++
tools/objtool/check.c                         | 64 +++++++++++++++++--
5 files changed, 91 insertions(+), 5 deletions(-)
[PATCH 0/3] Support intra-function call validation
Posted by Rui Qi 1 year, 11 months ago
Since kernel version 5.4.250 LTS, there has been an issue with the kernel live patching feature becoming unavailable. When compiling the sample code for kernel live patching, the following message is displayed when enabled:

livepatch: klp_check_stack: kworker/u256:6:23490 has an unreliable stack

After investigation, it was found that this is due to objtool not supporting intra-function calls, resulting in incorrect orc entry generation.

This patchset adds support for intra-function calls, allowing the kernel live patching feature to work correctly.

Alexandre Chartre (2):
  objtool: is_fentry_call() crashes if call has no destination
  objtool: Add support for intra-function calls

Rui Qi (1):
  x86/speculation: Support intra-function call validation

 arch/x86/include/asm/nospec-branch.h          |  7 ++
 include/linux/frame.h                         | 11 ++++
 .../Documentation/stack-validation.txt        |  8 +++
 tools/objtool/arch/x86/decode.c               |  6 ++
 tools/objtool/check.c                         | 64 +++++++++++++++++--
 5 files changed, 91 insertions(+), 5 deletions(-)

-- 
2.39.2 (Apple Git-143)
Re: [PATCH 0/3] Support intra-function call validation
Posted by qirui 1 year, 11 months ago
This issue only occurs in 5.4 LTS versions after LTS 5.4.250 (inclusive), and this patchset is based on commit 6e1f54a4985b63bc1b55a09e5e75a974c5d6719b (Linux 5.4.269)

On 2/26/24 5:49 PM, Rui Qi wrote:
> Since kernel version 5.4.250 LTS, there has been an issue with the kernel live patching feature becoming unavailable. When compiling the sample code for kernel live patching, the following message is displayed when enabled:
> 
> livepatch: klp_check_stack: kworker/u256:6:23490 has an unreliable stack
> 
> After investigation, it was found that this is due to objtool not supporting intra-function calls, resulting in incorrect orc entry generation.
> 
> This patchset adds support for intra-function calls, allowing the kernel live patching feature to work correctly.
> 
> Alexandre Chartre (2):
>    objtool: is_fentry_call() crashes if call has no destination
>    objtool: Add support for intra-function calls
> 
> Rui Qi (1):
>    x86/speculation: Support intra-function call validation
> 
>   arch/x86/include/asm/nospec-branch.h          |  7 ++
>   include/linux/frame.h                         | 11 ++++
>   .../Documentation/stack-validation.txt        |  8 +++
>   tools/objtool/arch/x86/decode.c               |  6 ++
>   tools/objtool/check.c                         | 64 +++++++++++++++++--
>   5 files changed, 91 insertions(+), 5 deletions(-)
> 
Re: [PATCH 0/3] Support intra-function call validation
Posted by Josh Poimboeuf 1 year, 11 months ago
On Mon, Feb 26, 2024 at 07:33:53PM +0800, qirui wrote:
> This issue only occurs in 5.4 LTS versions after LTS 5.4.250
> (inclusive), and this patchset is based on commit
> 6e1f54a4985b63bc1b55a09e5e75a974c5d6719b (Linux 5.4.269)

Does the bug also exist in mainline?  If not, why?

-- 
Josh
Re: [External] Re: [PATCH 0/3] Support intra-function call validation
Posted by Rui Qi 1 year, 11 months ago
I tested the mainline kernel v6.8-rc5 without this problem, as I said before, this problem only occurs in 5.4 LTS, to be precise, it can occur from v5.4.217, with CONFIG_RETPOLINE and CONFIG_LIVEPATCH enabled

BTW: The patch for V2 version has been sent out. We can discuss based on that. Thank you!
https://lore.kernel.org/stable/20240228024535.79980-1-qirui.001@bytedance.com/T/#t

On 2/27/24 1:28 AM, Josh Poimboeuf wrote:
> On Mon, Feb 26, 2024 at 07:33:53PM +0800, qirui wrote:
>> This issue only occurs in 5.4 LTS versions after LTS 5.4.250
>> (inclusive), and this patchset is based on commit
>> 6e1f54a4985b63bc1b55a09e5e75a974c5d6719b (Linux 5.4.269)
> 
> Does the bug also exist in mainline?  If not, why?
>