linux-kernel - Build/boot problem with 7b4537199a4a (Re: [PATCH v6 02/10] kbuild: link symbol CRCs at final link, removing CONFIG_MODULE_REL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <38605f6a-a568-f884-f06f-ea4da5b214f0@csgroup.eu>
Date:   Sat, 20 Aug 2022 10:02:04 +0000
From:   Christophe Leroy <christophe.leroy@...roup.eu>
To:     Masahiro Yamada <masahiroy@...nel.org>,
        "linux-kbuild@...r.kernel.org" <linux-kbuild@...r.kernel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Nicolas Schier <nicolas@...sle.eu>,
        Peter Zijlstra <peterz@...radead.org>,
        "linux-modules@...r.kernel.org" <linux-modules@...r.kernel.org>,
        "llvm@...ts.linux.dev" <llvm@...ts.linux.dev>,
        Ard Biesheuvel <ardb@...nel.org>,
        Sami Tolvanen <samitolvanen@...gle.com>,
        "linuxppc-dev@...ts.ozlabs.org" <linuxppc-dev@...ts.ozlabs.org>,
        "Kirill A . Shutemov" <kirill.shutemov@...ux.intel.com>
Subject: Build/boot problem with 7b4537199a4a (Re: [PATCH v6 02/10] kbuild:
 link symbol CRCs at final link, removing CONFIG_MODULE_REL_CRCS)

Hi,

Le 13/05/2022 à 13:39, Masahiro Yamada a écrit :
> include/{linux,asm-generic}/export.h defines a weak symbol, __crc_*
> as a placeholder.
> 
> Genksyms writes the version CRCs into the linker script, which will be
> used for filling the __crc_* symbols. The linker script format depends
> on CONFIG_MODULE_REL_CRCS. If it is enabled, __crc_* holds the offset
> to the reference of CRC.
> 
> It is time to get rid of this complexity.
> 
> Now that modpost parses text files (.*.cmd) to collect all the CRCs,
> it can generate C code that will be linked to the vmlinux or modules.
> 
> Generate a new C file, .vmlinux.export.c, which contains the CRCs of
> symbols exported by vmlinux. It is compiled and linked to vmlinux in
> scripts/link-vmlinux.sh.
> 
> Put the CRCs of symbols exported by modules into the existing *.mod.c
> files. No additional build step is needed for modules. As before,
> *.mod.c are compiled and linked to *.ko in scripts/Makefile.modfinal.
> 
> No linker magic is used here. The new C implementation works in the
> same way, whether CONFIG_RELOCATABLE is enabled or not.
> CONFIG_MODULE_REL_CRCS is no longer needed.
> 
> Previously, Kbuild invoked additional $(LD) to update the CRCs in
> objects, but this step is unneeded too.
> 
> Signed-off-by: Masahiro Yamada <masahiroy@...nel.org>
> Tested-by: Nathan Chancellor <nathan@...nel.org>
> Tested-by: Nicolas Schier <nicolas@...sle.eu>
> Reviewed-by: Nicolas Schier <nicolas@...sle.eu>

Problem with v6.0-rc1
Problem with v5.19
No problem with v5.18

Bisected to 7b4537199a4a ("kbuild: link symbol CRCs at final link, 
removing CONFIG_MODULE_REL_CRCS")

The above patch leads to the following problem building 
mpc85xx_defconfig + CONFIG_RELOCATABLE

   LD      vmlinux
   SYSMAP  System.map
   SORTTAB vmlinux
   CHKREL  vmlinux
WARNING: 451 bad relocations
c0b0f26d R_PPC_UADDR32     .head.text-0x3ff9f2bc
c0b0f271 R_PPC_UADDR32     .head.text-0x3ffac300
c0b0f275 R_PPC_UADDR32     .head.text-0x3ffb0bdc
c0b0f279 R_PPC_UADDR32     .head.text-0x3fe1e080
c0b0f27d R_PPC_UADDR32     .head.text-0x3fe1df4c
c0b0f281 R_PPC_UADDR32     .head.text-0x3fe21514
c0b0f285 R_PPC_UADDR32     .head.text-0x3fe211c0
c0b0f289 R_PPC_UADDR32     .head.text-0x3ffabda0
c0b0f28d R_PPC_UADDR32     .head.text-0x3fe21258
c0b0f291 R_PPC_UADDR32     .head.text-0x3fe074d0
c0b0f295 R_PPC_UADDR32     .head.text-0x3fe07ad4
c0b0f299 R_PPC_UADDR32     .head.text-0x3fe13470
c0b0f29d R_PPC_UADDR32     .head.text-0x3fe22700
c0b0f2a1 R_PPC_UADDR32     .head.text-0x3ff4b8e0
c0b0f2a5 R_PPC_UADDR32     .head.text-0x3fe08320
c0b0f2a9 R_PPC_UADDR32     .head.text-0x3fe220dc
c0b0f2ad R_PPC_UADDR32     .head.text-0x3fe21da0
c0b0f2b1 R_PPC_UADDR32     .head.text-0x3ff89dc0
c0b0f2b5 R_PPC_UADDR32     .head.text-0x3fe16524
c0b0f2b9 R_PPC_UADDR32     .head.text-0x3fe1ef74
c0b0f2bd R_PPC_UADDR32     .head.text-0x3ff98b84
c0b0f2c1 R_PPC_UADDR32     .head.text-0x3fdef9a0
c0b0f2c5 R_PPC_UADDR32     .head.text-0x3fdf21ac
c0b0f2c9 R_PPC_UADDR32     .head.text-0x3ff993c4
...
c0b0f969 R_PPC_UADDR32     .head.text-0x3ff89dc0
c0b0f96d R_PPC_UADDR32     .head.text-0x3fe9ad40
c0b0f971 R_PPC_UADDR32     .head.text-0x3ff2eb00
c0b0f975 R_PPC_UADDR32     .head.text-0x3ff89dc0

And boot fails:

Run /init as init process
kernel tried to execute user page (0) - exploit attempt? (uid: 0)
BUG: Unable to handle kernel instruction fetch (NULL pointer?)
Faulting instruction address: 0x00000000
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K MPC8544 DS
Modules linked in:
CPU: 0 PID: 1 Comm: init Not tainted 5.18.0-rc1-00054-g7b4537199a4a #1523
NIP:  00000000 LR: c00150e4 CTR: 00000000
REGS: c3091e10 TRAP: 0400   Not tainted  (5.18.0-rc1-00054-g7b4537199a4a)
MSR:  00009000 <EE,ME>  CR: 88000422  XER: 20000000

GPR00: 00004000 c3091f00 c30c8000 00000000 00000013 b7bb9f4c b7bd8f60 
bfee6650
GPR08: 00000054 00000000 c0b0f26d 00000000 c13b0000 00000000 bfee6668 
00000000
GPR16: 84e08000 00000000 08000000 00000064 00000000 00102000 00000001 
00000001
GPR24: 00000001 00000001 b7b9c7d0 10000034 00000009 b7bd8f38 b7bd9854 
b7bd8688
NIP [00000000] 0x0
LR [c00150e4] ret_from_syscall+0x0/0x28
Call Trace:
[c3091f00] [c0000af0] InstructionStorage+0x150/0x160 (unreliable)
--- interrupt: c00 at 0xb7bb28e8
NIP:  b7bb28e8 LR: b7bb1384 CTR: b7bb1218
REGS: c3091f10 TRAP: 0c00   Not tainted  (5.18.0-rc1-00054-g7b4537199a4a)
MSR:  0002d000 <CE,EE,PR,ME>  CR: 28000422  XER: 20000000

GPR00: 0000002d bfee61f0 00000000 00000000 00000013 b7bb9f4c b7bd8f60 
bfee6650
GPR08: 00000054 00000020 bfee6648 00000000 00000001 00000000 bfee6668 
00000000
GPR16: 84e08000 00000000 08000000 00000064 00000000 00102000 00000001 
00000001
GPR24: 00000001 00000001 b7b9c7d0 10000034 00000009 b7bd8f38 b7bd9854 
b7bd8688
NIP [b7bb28e8] 0xb7bb28e8
LR [b7bb1384] 0xb7bb1384
--- interrupt: c00
Instruction dump:
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX XXXXXXXX
---[ end trace 0000000000000000 ]---

Kernel panic - not syncing: Attempted to kill init! exitcode=0x0000000b



Christophe