linux-kernel - Re: more build problems with "Makefile: move stackprotector availability out of Kconfig"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 17 Oct 2017 17:23:15 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Kees Cook <keescook@...omium.org>
Cc:     Mark Brown <broonie@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>
Subject: Re: more build problems with "Makefile: move stackprotector
 availability out of Kconfig"

On Tue, Oct 17, 2017 at 1:00 PM, Arnd Bergmann <arnd@...db.de> wrote:
> Hi Kees,
>
> On my test box, current linux-next kernels fail to build due to the
> patch that introduces CONFIG_CC_STACKPROTECTOR_AUTO, with my mainline
> gcc
> builds up to gcc-5.5.0. gcc-6 and higher work fine, as
> scripts/gcc-x86_64-has-stack-protector.sh returns 'y' for those.
>
> Using the compilers provided by Ubuntu (4.6/4.7/4.8/4.9), everything
> also works as expected, so my interpretation is that mainline gcc did
> not enable the stack protector until gcc-6, while distributions did.
>
> Do you agree with that interpretation?

It's probably a little different. I tried bisecting the gcc commit that fixed
the issue for me, and ended up with this commit

https://gitlab.indel.ch/thirdparty/gcc/commit/c14bac81551d6769741c2b1cc55e04d94fe8d3a7

that caused the target to change from x86_64-unknown-linux to
x86_64-pc-linux, and apparently caused the compiler bootstrap
to incorrectly identify the capabilities of the assembler. As a result,
the assembler output inside of scripts/gcc-x86_64-has-stack-protector.sh
that should be

        .file   ""
        .text
        .globl  foo
        .type   foo, @function
foo:
        pushq   %rbp
        movq    %rsp, %rbp
        subq    $208, %rsp
        movq    %gs:40, %rax
        movq    %rax, -8(%rbp)
        xorl    %eax, %eax
        movl    $3, %eax
        movq    -8(%rbp), %rdx
        xorq    %gs:40, %rdx
        je      .L3
        call    __stack_chk_fail
.L3:
        leave
        ret
        .size   foo, .-foo
        .ident  "GCC: (GNU) 6.1.1 20160729"
        .section        .note.GNU-stack,"",@progbits

ends up looking like

        .file   ""
        .text
        .globl  foo
        .type   foo, @function
foo:
.LFB0:
        pushq   %rbp
.LCFI0:
        movq    %rsp, %rbp
.LCFI1:
        subq    $208, %rsp
        movq    __stack_chk_guard(%rip), %rax
        movq    %rax, -8(%rbp)
        xorl    %eax, %eax
        movl    $3, %eax
        movq    -8(%rbp), %rdx
        xorq    __stack_chk_guard(%rip), %rdx
        je      .L3
        call    __stack_chk_fail
.L3:
        leave
.LCFI2:
        ret
.LFE0:
        .size   foo, .-foo
        .section        .eh_frame,"aw",@progbits
.Lframe1:
        .long   .LECIE1-.LSCIE1
.LSCIE1:
        .long   0
        .byte   0x3
        .string ""
        .byte   0x1
        .byte   0x78
        .byte   0x10
        .byte   0xc
        .byte   0x7
        .byte   0x8
        .byte   0x90
        .byte   0x1
        .align 8
.LECIE1:
.LSFDE1:
        .long   .LEFDE1-.LASFDE1
.LASFDE1:
        .long   .LASFDE1-.Lframe1
        .quad   .LFB0
        .quad   .LFE0-.LFB0
        .byte   0x4
        .long   .LCFI0-.LFB0
        .byte   0xe
        .byte   0x10
        .byte   0x86
        .byte   0x2
        .byte   0x4
        .long   .LCFI1-.LCFI0
        .byte   0xd
        .byte   0x6
        .byte   0x4
        .long   .LCFI2-.LCFI1
        .byte   0xc
        .byte   0x7
        .byte   0x8
        .align 8
.LEFDE1:
        .ident  "GCC: (GNU) 6.0.0 20150728 (experimental)"
        .section        .note.GNU-stack,"",@progbits