linux-kernel - Re: [PATCH] arm: Blacklist gcc 4.8.[012] and 4.9.0 with CONFIG_FRAME

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 11 Oct 2014 14:04:47 -0400
From:	Peter Hurley <peter@...leysoftware.com>
To:	Mikael Pettersson <mikpelinux@...il.com>
CC:	Russell King - ARM Linux <linux@....linux.org.uk>,
	Aaro Koskinen <aaro.koskinen@....fi>,
	Johannes Weiner <hannes@...xchg.org>,
	linux-kernel@...r.kernel.org, Felipe Balbi <balbi@...com>,
	Rabin Vincent <rabin@....in>
Subject: Re: [PATCH] arm: Blacklist gcc 4.8.[012] and 4.9.0 with CONFIG_FRAME_POINTER

On 10/11/2014 12:33 PM, Mikael Pettersson wrote:
> Peter Hurley writes:
>  > On 10/10/2014 12:36 PM, Russell King - ARM Linux wrote:
>  > > On Fri, Oct 10, 2014 at 12:26:14PM -0400, Peter Hurley wrote:
>  > >> gcc versions 4.8.[012] and 4.9.0 generates code that prematurely
>  > >> adjusts the stack pointer such that still-to-be-referenced locals
>  > >> are below the stack pointer, which allows them to be overwritten
>  > >> by interrupts.
>  > > 
>  > > I would much rather do this in asm-offsets.c, along side the other ARM
>  > > specific buggy compiler test(s).  I'm presently putting together such
>  > > a patch.
>  > > 
>  > > The information in the thread on linux-omap says only GCC 4.8.1 and
>  > > GCC 4.8.2.  Where do you get the other versions from?
>  > 
>  > The gcc PR linked in the commit message; see the "Known to fail" field.
> 
> The 4.8.0 release is broken, but the 4.9.0 one is not.  It's unfortunate,
> but "4.9.0" may refer to "the 4.9.0 release" or to "some point after trunk
> forked 4.8 branch up to and including the 4.9.0 release point".  In this
> case, it's the latter -- this can be inferred from the fact that the
> fix went into trunk in October 2013 while 4.9.0 was branched and released
> during the first half of 2014.

Is there a reasonably quick way to determine if a particular commit is
in a particular release of gcc?

Starting from the mainline viewcvs revision page for this fix here,
https://gcc.gnu.org/viewcvs/gcc?view=revision&revision=204203
(which is the link from the PR for the fix), navigation to anywhere
else in the gcc tree is impossible. I can't even look at the Changelog.

Same with the backport.

Inferring by date seems error-prone.

Regards,
Peter Hurley


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/