linux-hardening - Re: [PATCH 1/3] selftests/exec: Build both static and non-static load

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <6b98f32c-5ce6-44cb-9288-1348c7e50909@nvidia.com>
Date: Mon, 19 Aug 2024 12:52:40 -0700
From: John Hubbard <jhubbard@...dia.com>
To: Muhammad Usama Anjum <Usama.Anjum@...labora.com>, Kees Cook
	<keescook@...omium.org>
CC: "H . J . Lu" <hjl.tools@...il.com>, Chris Kennelly <ckennelly@...gle.com>,
	Eric Biederman <ebiederm@...ssion.com>, Shuah Khan <shuah@...nel.org>,
	Fangrui Song <maskray@...gle.com>, Andrew Morton <akpm@...ux-foundation.org>,
	Yang Yingliang <yangyingliang@...wei.com>, <linux-mm@...ck.org>,
	<linux-kselftest@...r.kernel.org>, Mike Rapoport <rppt@...nel.org>, "Rui
 Salvaterra" <rsalvaterra@...il.com>, Victor Stinner <vstinner@...hat.com>,
	"Jan Palus" <jpalus@...tmail.com>, Al Viro <viro@...iv.linux.org.uk>,
	"Christian Brauner" <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	<linux-kernel@...r.kernel.org>, <linux-fsdevel@...r.kernel.org>,
	<linux-hardening@...r.kernel.org>
Subject: Re: [PATCH 1/3] selftests/exec: Build both static and non-static
 load_address tests

On 8/19/24 12:41 PM, John Hubbard wrote:
> On 8/18/24 8:55 PM, Muhammad Usama Anjum wrote:
>> On 8/7/24 3:22 PM, Muhammad Usama Anjum wrote:
>>> On 5/9/24 11:16 AM, Kees Cook wrote:
...
>>> make ARCH=arm CROSS_COMPILE=arm-linux-gnueabihf-
>>> arm-linux-gnueabihf-gcc -Wall -Wno-nonnull -D_GNU_SOURCE=
>>> -Wl,-z,max-page-size=0x1000 \
>>>          -fPIE -static-pie load_address.c -o
>>> /home/usama/repos/kernel/linux_mainline/tools/testing/selftests/exec/load_address.static.0x1000
>>> /usr/lib/gcc-cross/arm-linux-gnueabihf/12/../../../../arm-linux-gnueabihf/bin/ld:
>>> cannot find rcrt1.o: No such file or directory
>>> collect2: error: ld returned 1 exit status
>>> make: *** [Makefile:39:
>>> /home/usama/repos/kernel/linux_mainline/tools/testing/selftests/exec/load_address.static.0x1000]
>>> Error 1
> 
> This appears to be because that particular cross compiler setup
> (the libc part of the installation) fails to include rcrt1.o. I was
> able to reproduce this on Ubuntu 23.04, using their standard arm
> cross compilation packages for gcc and libc.
> 
> Also, -static-pie is what is causing the linker to look for rcrt1.o.
> If you change the invocation from "-static-pie" to "-static -pie",
> then linking succeeds.
> 
> Putting all of this together, I think we were are seeing is that
> even though "-static-pie" was added to gcc 8.1+, and even though
> the cross-compiler installation here shows gcc 12.3.0, the libc
> support for that feature is lagging. In other words, the cross
> installation of libc is effectively at something earlier than
> gcc 8.1's needs.
> 
> So I think this means that we need to fix up the distros'packages,
> and meanwhile, fall back to something like "-static-pie" for
> selftests.
> 

Or, another way of handling this would be to say, "gcc 8.1 is
sufficiently old, and cross-compiling of kselftests is sufficiently
rare, that we can wait for the cross compilers to catch up.

Until then, only native builds of kselftests are supported".

Shuah, you would know whether or not that's a reasonable thing
to claim--what do you think? I'm just trying to list all of the
options so that people can decide which way to go here.


thanks,
-- 
John Hubbard
NVIDIA