On Fri, 2017-09-01 at 11:58 -0700, Kees Cook wrote:
>
> The section stuff is supposed to be a trick to push the error case off
> into the .text.unlikely area to avoid needing a jmp over the handler
> and with possibly some redundancy removal done by the compiler (though
> this appears to be rather limited) if it notices a bunch of error
> paths are the same. However, in your disassembly, it's inline (!!) in
> the code, as if "pushsection" and "popsection" were entirely ignored.
>
> And when I make my own in6_dev_getx(), I see the same disassembly:
>
> 0xffffffff818a757b <+181>: lock incl 0x1e0(%rbx)
> 0xffffffff818a7582 <+188>: js 0xffffffff818a7584 <in6_dev_getx+190>
> 0xffffffff818a7584 <+190>: lea 0x1e0(%rbx),%rcx
> 0xffffffff818a758b <+197>: (bad)
>
> Which is VERY different from how it looks in other places!
>
> e.g. from lkdtm_REFCOUNT_INC_SATURATED:
>
> 0xffffffff815657df <+47>: lock incl -0xc(%rbp)
> 0xffffffff815657e3 <+51>: js 0xffffffff81565cac
> ...
> 0xffffffff81565cac: lea -0xc(%rbp),%rcx
> 0xffffffff81565cb0: (bad)
>
> So, at least I can reproduce this in the build now. I must not be
> exercising these paths. FWIW, this is with Ubuntu's 6.3.0 gcc.
>
> I'll try to figure out what's going on here...
Heh, make in6_dev_getx() __always_inline.
swapper/0-1 [000] d..1 1.438587: ip6_route_init_special_entries:
PRE refs.counter:3
swapper/0-1 [000] d..1 1.438590: ip6_route_init_special_entries:
POST refs.counter:4
swapper/0-1 [000] d..1 1.438591: ip6_route_init_special_entries:
PRE refs.counter:4
swapper/0-1 [000] d..1 1.438592: ip6_route_init_special_entries:
POST refs.counter:5
swapper/0-1 [000] d..1 1.438592: ip6_route_init_special_entries:
PRE refs.counter:5
swapper/0-1 [000] d..1 1.438593: ip6_route_init_special_entries:
POST refs.counter:6
-Mike
