lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CALCETrUYA60fWu+=MviKx0NmW+_ppsOcv-ShUXdbyM4EjyfzHQ@mail.gmail.com>
Date:   Wed, 13 May 2020 20:50:03 -0700
From:   Andy Lutomirski <luto@...capital.net>
To:     Linus Torvalds <torvalds@...ux-foundation.org>
Cc:     Nick Desaulniers <ndesaulniers@...gle.com>,
        Borislav Petkov <bp@...e.de>, Arnd Bergmann <arnd@...db.de>,
        Arvind Sankar <nivedita@...m.mit.edu>,
        Kalle Valo <kvalo@...eaurora.org>,
        linux-wireless <linux-wireless@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "the arch/x86 maintainers" <x86@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Thomas Gleixner <tglx@...utronix.de>
Subject: Re: gcc-10: kernel stack is corrupted and fails to boot

> On May 13, 2020, at 7:20 PM, Linus Torvalds <torvalds@...ux-foundation.org> wrote:
>
> On Wed, May 13, 2020 at 5:51 PM Nick Desaulniers
> <ndesaulniers@...gle.com> wrote:
>>
>> Are you sure LTO treats empty asm statements differently than full
>> memory barriers in regards to preventing tail calls?
>
> It had better.
>
> At link-time, there is nothing left of an empty asm statement. So by
> the time the linker runs, it only sees
>
>    call xyz
>    ret
>
> in the object code. At that point, it's somewhat reasonable for any
> link-time optimizer (or an optimizing assembler, for that matter) to
> say "I'll just turn that sequence into a simple 'jmp xyz' instead".
>

What, what?

LTO isn’t a linker taking regular .o files full of regular machine
code and optimizing it. That’s nuts.  LTO takes an intermediate
representation and optimizes *that*. This will contain actual
indications that something is inline asm.  If LTO starts rewriting
inline asm, then I bet all kinds of things will go wrong and this is
the least of our worries.  Also, trying to do the kinds of stuff LTO
does by looking at just machine code isn't going to work.

So the difference between:

asm volatile ("nop");

and

asm volatile ("");

will be, literally, the absence of the nop.  (And alignment changes, etc.)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ