Messages in this thread | | | Date | Wed, 20 Jul 2022 12:36:38 -0700 | From | Kees Cook <> | Subject | Re: [patch 00/38] x86/retbleed: Call depth tracking mitigation |
| |
On Wed, Jul 20, 2022 at 11:07:26AM -0700, Linus Torvalds wrote: > On Wed, Jul 20, 2022 at 10:50 AM Steven Rostedt <rostedt@goodmis.org> wrote: > > > > [ 2.464117] missing return thunk: lkdtm_rodata_do_nothing+0x0/0x8-lkdtm_rodata_do_nothing+0x5/0x8: e9 00 00 00 00 > > Well, that looks like a "jmp" instruction that has never been relocated.
Peter, Josh, and I drilled down into this recently[1] and discussed some solutions[2].
This test is doing what's expected: it needed an arch-agnostic way to do a "return", and when the way to do that changed, it also changed (which would normally be good, but in this case broke it). It's been happily being used as part of the per-section architectural behavior testing[3] of execution-vs-expected-memory-permissions for quite a long while now.
I'd rather not remove it (or do it dynamically) since the point is to test what has been generated by the toolchain/build process and stuffed into the .rodata section. i.e. making sure gadgets there can't be executed, that the boot-time section permission-setting works correctly, etc. Before the retbleed mitigation, this test worked for all architectures; I'd hate to regress it. :(
-Kees
[1] https://lore.kernel.org/lkml/Ys66hwtFcGbYmoiZ@hirez.programming.kicks-ass.net/ [2] https://lore.kernel.org/lkml/20220713213133.455599-1-keescook@chromium.org/ [3] e.g. https://linux.kernelci.org/test/plan/id/62d61ee8ef31e0f0faa39bff/
-- Kees Cook
| |