linux-kernel - Re: [PATCH v2 3/6] x86/cpu: Remove CONFIG_X86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YgOrT5emtH2damsR@zn.tnic>
Date:   Wed, 9 Feb 2022 12:53:51 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Kees Cook <keescook@...omium.org>
Cc:     Peter Zijlstra <peterz@...radead.org>, X86 ML <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Lai Jiangshan <jiangshanlai@...il.com>
Subject: Re: [PATCH v2 3/6] x86/cpu: Remove CONFIG_X86_SMAP and "nosmap"

On Tue, Feb 08, 2022 at 06:56:40PM -0800, Kees Cook wrote:
> Cool; yeah, that's kind of what I was expecting. I have a knee-jerk "I
> don't want to touch this again later" reaction to seeing it always
> applied instead of gated by CONFIG_X86 or something, but then, I doubt
> that'll be hard to change when/if objtool becomes multi-architecture.

Yah, what I had doesn't build with 32-bit allnoconfig etc because of
CONFIG_STACK_VALIDATION=n or so. So I ended up doing, see end.

In this case, it gets set only when the earlier LTO_CLANG/STACK/VMLINUX
validation options are enabled.

We could do an is_enabled check around it but what would be the correct
criterium to enable uaccess validation?

> Consider the update as:
> 
> Reviewed-by: Kees Cook <keescook@...omium.org>

Thx.

---
diff --git a/scripts/Makefile.build b/scripts/Makefile.build
index a4b89b757287..404ea669ecca 100644
--- a/scripts/Makefile.build
+++ b/scripts/Makefile.build
@@ -233,7 +233,7 @@ objtool_args =								\
 	$(if $(CONFIG_FRAME_POINTER),, --no-fp)				\
 	$(if $(CONFIG_GCOV_KERNEL)$(CONFIG_LTO_CLANG), --no-unreachable)\
 	$(if $(CONFIG_RETPOLINE), --retpoline)				\
-	$(if $(CONFIG_X86_SMAP), --uaccess)				\
+	--uaccess							\
 	$(if $(CONFIG_FTRACE_MCOUNT_USE_OBJTOOL), --mcount)		\
 	$(if $(CONFIG_SLS), --sls)
 
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 666f7bbc13eb..fbdb531cca18 100755
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -140,9 +140,9 @@ objtool_link()
 		if is_enabled CONFIG_RETPOLINE; then
 			objtoolopt="${objtoolopt} --retpoline"
 		fi
-		if is_enabled CONFIG_X86_SMAP; then
-			objtoolopt="${objtoolopt} --uaccess"
-		fi
+
+		objtoolopt="${objtoolopt} --uaccess"
+
 		if is_enabled CONFIG_SLS; then
 			objtoolopt="${objtoolopt} --sls"
 		fi
-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette