linux-kernel - Re: PROBLEM: 5.11.0-rc7 fails to compile with error: ‘-mindirect-branch’ and ‘-fcf-protection’ are not compatible

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 7 Feb 2021 19:26:01 -0500
From:   Stuart Little <achirvasub@...il.com>
To:     Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Marco Elver <elver@...gle.com>, Arnd Bergmann <arnd@...db.de>
Cc:     linux-arch@...r.kernel.org, linux-kernel@...r.kernel.org,
        kasan-dev@...glegroups.com
Subject: Re: PROBLEM: 5.11.0-rc7 fails to compile with error: ‘-mindirect-branch’ and ‘-fcf-protection’ are not compatible

The result of the bisect on the issue reported in the previous message:

--- cut ---

20bf2b378729c4a0366a53e2018a0b70ace94bcd is the first bad commit
commit 20bf2b378729c4a0366a53e2018a0b70ace94bcd
Author: Josh Poimboeuf <jpoimboe@...hat.com>
Date:   Thu Jan 28 15:52:19 2021 -0600

    x86/build: Disable CET instrumentation in the kernel
    
    With retpolines disabled, some configurations of GCC, and specifically
    the GCC versions 9 and 10 in Ubuntu will add Intel CET instrumentation
    to the kernel by default. That breaks certain tracing scenarios by
    adding a superfluous ENDBR64 instruction before the fentry call, for
    functions which can be called indirectly.
    
    CET instrumentation isn't currently necessary in the kernel, as CET is
    only supported in user space. Disable it unconditionally and move it
    into the x86's Makefile as CET/CFI... enablement should be a per-arch
    decision anyway.
    
     [ bp: Massage and extend commit message. ]
    
    Fixes: 29be86d7f9cb ("kbuild: add -fcf-protection=none when using retpoline flags")
    Reported-by: Nikolay Borisov <nborisov@...e.com>
    Signed-off-by: Josh Poimboeuf <jpoimboe@...hat.com>
    Signed-off-by: Borislav Petkov <bp@...e.de>
    Reviewed-by: Nikolay Borisov <nborisov@...e.com>
    Tested-by: Nikolay Borisov <nborisov@...e.com>
    Cc: <stable@...r.kernel.org>
    Cc: Seth Forshee <seth.forshee@...onical.com>
    Cc: Masahiro Yamada <yamada.masahiro@...ionext.com>
    Link: https://lkml.kernel.org/r/20210128215219.6kct3h2eiustncws@treble

 Makefile          | 6 ------
 arch/x86/Makefile | 3 +++
 2 files changed, 3 insertions(+), 6 deletions(-)

--- end ---

On Sun, Feb 07, 2021 at 06:31:22PM -0500, Stuart Little wrote:
> I am trying to compile on an x86_64 host for a 32-bit system; my config is at
> 
> https://termbin.com/v8jl
> 
> I am getting numerous errors of the form
> 
> ./include/linux/kasan-checks.h:17:1: error: ‘-mindirect-branch’ and ‘-fcf-protection’ are not compatible
> 
> and
> 
> ./include/linux/kcsan-checks.h:143:6: error: ‘-mindirect-branch’ and ‘-fcf-protection’ are not compatible
> 
> and
> 
> ./arch/x86/include/asm/arch_hweight.h:16:1: error: ‘-mindirect-branch’ and ‘-fcf-protection’ are not compatible
> 
> (those include files indicated whom I should add to this list; apologies if this reaches you in error).
> 
> The full log of the build is at
> 
> https://termbin.com/wbgs
> 
> ---
> 
> 5.11.0-rc6 built fine last week on this same setup.