| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 3 May 2022 11:55:11 +0900
From: Masahiro Yamada <masahiroy@...nel.org>
To: Linux Kbuild mailing list <linux-kbuild@...r.kernel.org>
Cc: Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
Michal Marek <michal.lkml@...kovi.net>,
Nick Desaulniers <ndesaulniers@...gle.com>
Subject: Re: [PATCH v2 19/26] kbuild: embed symbol versions at final link of
vmlinux or modules
On Sun, May 1, 2022 at 5:42 PM Masahiro Yamada <masahiroy@...nel.org> wrote:
>
> Do not update objects with version CRCs while the directory descending.
>
> Do it at the final link stage.
>
> Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
As 0-day bot reported, this does not work for CONFIG_MODULE_REL_CRCS.
I will send v3.
> ---
>
> (no changes since v1)
>
> scripts/Makefile.build | 22 +++-------------------
> scripts/Makefile.modfinal | 3 ++-
> scripts/link-vmlinux.sh | 4 +++-
> 3 files changed, 8 insertions(+), 21 deletions(-)
>
> diff --git a/scripts/Makefile.build b/scripts/Makefile.build
> index a1023868775f..cec17b28de42 100644
> --- a/scripts/Makefile.build
> +++ b/scripts/Makefile.build
> @@ -162,15 +162,9 @@ ifdef CONFIG_MODVERSIONS
> # o if <file>.o doesn't contain a __ksymtab version, i.e. does
> # not export symbols, it's done.
> # o otherwise, we calculate symbol versions using the good old
> -# genksyms on the preprocessed source and postprocess them in a way
> -# that they are usable as a linker script
> -# o generate .tmp_<file>.o from <file>.o using the linker to
> -# replace the unresolved symbols __crc_exported_symbol with
> -# the actual value of the checksum generated by genksyms
> -# o remove .tmp_<file>.o to <file>.o
> -
> -# Generate .o.symversions files for each .o with exported symbols, and link these
> -# to the kernel and/or modules at the end.
> +# genksyms on the preprocessed source and dump them into the .cmd file.
> +# o modpost will extract versions from the .cmd file and create linker
> +# scripts used to link the kernel and/or modules.
>
> genksyms_format_rel_crc := [^_]*__crc_\([^ ]*\) = \.; LONG(\([^)]*\)).*
> genksyms_format_normal := __crc_\(.*\) = \(.*\);
> @@ -188,12 +182,6 @@ gen_symversions = \
>
> cmd_gen_symversions_c = $(call gen_symversions,c)
>
> -cmd_modversions = \
> - if [ -r $@...mversions ]; then \
> - $(LD) $(KBUILD_LDFLAGS) -r -o $(@D)/.tmp_$(@F) $@ \
> - -T $@...mversions; \
> - mv -f $(@D)/.tmp_$(@F) $@; \
> - fi
> endif
>
> ifdef CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT
> @@ -273,7 +261,6 @@ define rule_cc_o_c
> $(call cmd,checkdoc)
> $(call cmd,gen_objtooldep)
> $(call cmd,gen_symversions_c)
> - $(if $(CONFIG_LTO_CLANG),,$(call cmd,modversions))
> $(call cmd,record_mcount)
> endef
>
> @@ -282,7 +269,6 @@ define rule_as_o_S
> $(call cmd,gen_ksymdeps)
> $(call cmd,gen_objtooldep)
> $(call cmd,gen_symversions_S)
> - $(call cmd,modversions)
> endef
>
> # Built-in and composite module parts
> @@ -296,8 +282,6 @@ ifneq ($(CONFIG_LTO_CLANG)$(CONFIG_X86_KERNEL_IBT),)
> quiet_cmd_cc_prelink_modules = LD [M] $@
> cmd_cc_prelink_modules = \
> $(LD) $(ld_flags) -r -o $@ \
> - $(shell [ -s $(@:.prelink.o=.o.symversions) ] && \
> - echo -T $(@:.prelink.o=.o.symversions)) \
> --whole-archive $(filter-out FORCE,$^) \
> $(cmd_objtool)
>
> diff --git a/scripts/Makefile.modfinal b/scripts/Makefile.modfinal
> index 7f39599e9fae..d429e3f9ae1d 100644
> --- a/scripts/Makefile.modfinal
> +++ b/scripts/Makefile.modfinal
> @@ -34,6 +34,7 @@ quiet_cmd_ld_ko_o = LD [M] $@
> cmd_ld_ko_o += \
> $(LD) -r $(KBUILD_LDFLAGS) \
> $(KBUILD_LDFLAGS_MODULE) $(LDFLAGS_MODULE) \
> + $(addprefix -T, $(filter %.symver.lds, $(real-prereqs)))\
> -T scripts/module.lds -o $@ $(filter %.o, $^); \
> $(if $(ARCH_POSTLINK), $(MAKE) -f $(ARCH_POSTLINK) $@, true)
>
> @@ -56,7 +57,7 @@ if_changed_except = $(if $(call newer_prereqs_except,$(2))$(cmd-check), \
>
>
> # Re-generate module BTFs if either module's .ko or vmlinux changed
> -$(modules): %.ko: %$(mod-prelink-ext).o %.mod.o scripts/module.lds $(if $(KBUILD_BUILTIN),vmlinux) FORCE
> +$(modules): %.ko: %$(mod-prelink-ext).o %.mod.o $(if $(CONFIG_MODVERSIONS), %.symver.lds) scripts/module.lds $(if $(KBUILD_BUILTIN),vmlinux) FORCE
> +$(call if_changed_except,ld_ko_o,vmlinux)
> ifdef CONFIG_DEBUG_INFO_BTF_MODULES
> +$(if $(newer-prereqs),$(call cmd,btf_ko))
> diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
> index eceb3ee7ec06..8da5c0182665 100755
> --- a/scripts/link-vmlinux.sh
> +++ b/scripts/link-vmlinux.sh
> @@ -90,7 +90,6 @@ modpost_link()
>
> if is_enabled CONFIG_MODVERSIONS; then
> gen_symversions
> - lds="${lds} -T .tmp_symversions.lds"
> fi
>
> # This might take a while, so indicate that we're doing
> @@ -196,6 +195,9 @@ vmlinux_link()
> fi
>
> ldflags="${ldflags} ${wl}--script=${objtree}/${KBUILD_LDS}"
> + if is_enabled CONFIG_MODVERSIONS; then
> + ldflags="${ldflags} ${wl}--script=vmlinux.symver.lds"
> + fi
>
> # The kallsyms linking does not need debug symbols included.
> if [ "$output" != "${output#.tmp_vmlinux.kallsyms}" ] ; then
> --
> 2.32.0
>
--
Best Regards
Masahiro Yamada
Powered by blists - more mailing lists