linux-kernel - Re: [PATCH] x86: assemble with -Wa,--noexecstack to avoid BFD 2.39 warning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 8 Aug 2022 13:31:53 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Nathan Chancellor <nathan@...nel.org>,
        Ard Biesheuvel <ardb@...nel.org>
Cc:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Nick Clifton <nickc@...hat.com>,
        Fangrui Song <maskray@...gle.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Jens Axboe <axboe@...nel.dk>, x86@...nel.org,
        "H. Peter Anvin" <hpa@...or.com>, Tom Rix <trix@...hat.com>,
        Masahiro Yamada <masahiroy@...nel.org>,
        "Kirill A. Shutemov" <kirill.shutemov@...ux.intel.com>,
        Nicolas Schier <n.schier@....de>,
        Brijesh Singh <brijesh.singh@....com>,
        Michael Roth <michael.roth@....com>,
        Kuppuswamy Sathyanarayanan 
        <sathyanarayanan.kuppuswamy@...ux.intel.com>,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
        Ben Dooks <ben-linux@...ff.org>,
        Heinrich Schuchardt <heinrich.schuchardt@...onical.com>
Subject: Re: [PATCH] x86: assemble with -Wa,--noexecstack to avoid BFD 2.39 warning

On Mon, Aug 8, 2022 at 12:31 PM Nathan Chancellor <nathan@...nel.org> wrote:
>
> On Mon, Aug 08, 2022 at 12:23:05PM -0700, Nick Desaulniers wrote:
> > Users of GNU ld (BFD) from binutils 2.39+ will observe multiple instance
> > of a new warning when linking kernels in the form:
> >
> >   ld: warning: arch/x86/realmode/rm/bioscall.o: missing .note.GNU-stack
> >   section implies executable stack
> >   ld: NOTE: This behaviour is deprecated and will be removed in a future
> >   version of the linker
> >
> > The object files producing these all happen to be out of line assembler
> > sources (*.S files).
> >
> > Generally, we would like to avoid the stack being executable. Because
> > there could be a need for the stack to be executable, assembler sources
> > have to opt-in to this security feature via explicit creation of the
> > .note.GNU-stack feature (which compilers create by default) or command
> > line flag --noexecstack.
> >
> > Boot tested defconfig and i386_defconfig in QEMU. If any assembler
> > sources do require executable stack, they can be built with
> > -Wa,--execstack, though the linker warning would have to be disabled. We
> > might need to extend this more generally to the top level Makefile for
> > all architectures, but I'm not equipped to test the result of such a
> > change.
> >
> > LLVM's LLD linker defaults to -z noexecstack, so this flag isn't
> > strictly necessary when linking with LLD, only BFD, but it doesn't hurt
> > to be explicit here for all linkers IMO.
> >
> > Link: https://lore.kernel.org/linux-block/3af4127a-f453-4cf7-f133-a181cce06f73@kernel.dk/
> > Link: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=ba951afb99912da01a6e8434126b8fac7aa75107
> > Link: https://github.com/llvm/llvm-project/issues/57009
> > Reported-by: Jens Axboe <axboe@...nel.dk>
> > Signed-off-by: Nick Desaulniers <ndesaulniers@...gle.com>
>
> FWIW, this warning appears for other architectures, as I have seen it
> with powerpc and s390 and there is also a patch for ARM:
>
> https://lore.kernel.org/20220721204709.445216-1-ben-linux@fluff.org/
>
> Perhaps this should be done for all architectures in the main Makefile?

Thanks for the link; I recall Ard mentioning the ELF segments are
ignored by the kernels loader in another thread.

Perhaps we should be adding
--no-warn-execstack
wrapped in an ld-option check to KBUILD_LDFLAGS at the top level?

>
> > ---
> >  arch/x86/Makefile                 | 2 ++
> >  arch/x86/boot/Makefile            | 2 +-
> >  arch/x86/boot/compressed/Makefile | 2 +-
> >  arch/x86/realmode/rm/Makefile     | 2 +-
> >  4 files changed, 5 insertions(+), 3 deletions(-)
> >
> > diff --git a/arch/x86/Makefile b/arch/x86/Makefile
> > index 7854685c5f25..571546775725 100644
> > --- a/arch/x86/Makefile
> > +++ b/arch/x86/Makefile
> > @@ -159,6 +159,8 @@ else
> >          KBUILD_CFLAGS += -mcmodel=kernel
> >  endif
> >
> > +KBUILD_AFLAGS        += -Wa,--noexecstack
> > +
> >  #
> >  # If the function graph tracer is used with mcount instead of fentry,
> >  # '-maccumulate-outgoing-args' is needed to prevent a GCC bug
> > diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
> > index b5aecb524a8a..d7f2130f2277 100644
> > --- a/arch/x86/boot/Makefile
> > +++ b/arch/x86/boot/Makefile
> > @@ -67,7 +67,7 @@ targets += cpustr.h
> >  # ---------------------------------------------------------------------------
> >
> >  KBUILD_CFLAGS        := $(REALMODE_CFLAGS) -D_SETUP
> > -KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  KBUILD_CFLAGS        += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)
> >  KBUILD_CFLAGS        += -fno-asynchronous-unwind-tables
> >  GCOV_PROFILE := n
> > diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
> > index 19e1905dcbf6..1587a21a132d 100644
> > --- a/arch/x86/boot/compressed/Makefile
> > +++ b/arch/x86/boot/compressed/Makefile
> > @@ -57,7 +57,7 @@ KBUILD_CFLAGS += -include $(srctree)/include/linux/hidden.h
> >  # that the compiler finds it even with out-of-tree builds (make O=/some/path).
> >  CFLAGS_sev.o += -I$(objtree)/arch/x86/lib/
> >
> > -KBUILD_AFLAGS  := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  GCOV_PROFILE := n
> >  UBSAN_SANITIZE :=n
> >
> > diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
> > index 83f1b6a56449..5f2fdafaa034 100644
> > --- a/arch/x86/realmode/rm/Makefile
> > +++ b/arch/x86/realmode/rm/Makefile
> > @@ -73,7 +73,7 @@ $(obj)/realmode.relocs: $(obj)/realmode.elf FORCE
> >
> >  KBUILD_CFLAGS        := $(REALMODE_CFLAGS) -D_SETUP -D_WAKEUP \
> >                  -I$(srctree)/arch/x86/boot
> > -KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__
> > +KBUILD_AFLAGS        := $(KBUILD_CFLAGS) -D__ASSEMBLY__ -Wa,--noexecstack
> >  KBUILD_CFLAGS        += -fno-asynchronous-unwind-tables
> >  GCOV_PROFILE := n
> >  UBSAN_SANITIZE := n
> > --
> > 2.37.1.559.g78731f0fdb-goog
> >



-- 
Thanks,
~Nick Desaulniers