linux-kernel - Re: [syzbot] upstream-arm64 build error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 20 Feb 2023 13:07:10 +0000
From:   Mark Rutland <mark.rutland@....com>
To:     syzbot <syzbot+f8ac312e31226e23302b@...kaller.appspotmail.com>
Cc:     catalin.marinas@....com, linux-arm-kernel@...ts.infradead.org,
        linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com,
        will@...nel.org, ardb@...nel.org
Subject: Re: [syzbot] upstream-arm64 build error

On Fri, Feb 17, 2023 at 02:39:55AM -0800, syzbot wrote:
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    2d3827b3f393 Merge branch 'for-next/core' into for-kernelci
> git tree:       git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
> console output: https://syzkaller.appspot.com/x/log.txt?x=160f19d7480000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=f5c7f0c5a0c5dbdb
> dashboard link: https://syzkaller.appspot.com/bug?extid=f8ac312e31226e23302b
> compiler:       Debian clang version 15.0.7, GNU ld (GNU Binutils for Debian) 2.35.2
> userspace arch: arm64
> 
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+f8ac312e31226e23302b@...kaller.appspotmail.com
> 
> failed to run ["make" "-j" "64" "ARCH=arm64" "CROSS_COMPILE=aarch64-linux-gnu-" "CC=clang" "Image.gz"]: exit status 2

For the benefit of others, the actual error from the console log is:

  LD      .tmp_vmlinux.kallsyms1
  aarch64-linux-gnu-ld: ID map text too big or misaligned
  make[1]: *** [scripts/Makefile.vmlinux:35: vmlinux] Error 1
  make: *** [Makefile:1264: vmlinux] Error 2

... and I see the same on for-next/core with my usual fuzzing configs applied
atop, building with GCC 12.1.0.

That "ID map text too big or misalignes" error is from an assertion in arm64's
vmlinux.lds.S, and if I hack that out, the kernel builds and the idmap text
section is 4K aligned and ~2900 bytes in size.

My config worked on v6.2-rc3, and bisecting led me to commit:

  3dcf60bbfd284e5e ("arm64: head: Clean the ID map and the HYP text to the PoC if needed")

... which plays with sections a bit, but doesn't do anything obviously wrong.

I think the error is misleading, and what's actually happening here is that the
size of the .idmap.text section hasn't been determined at the point the
assertion is tested.

With my config, the Image size is ~242MiB, and I think what's happening is that
some branches from .idmap.text to .text are (possibly) out-of-range, but the
linker doesn't know the final position of the sections yet and hasn't placed
PLTs, and doesn't know the final size of the sections.

I don't know much about the linker, so that's conjecture, but the below diff
got rid of the build error for me.

Thanks,
Mark.

---->8----
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index 212d93aca5e61..13d6f1018eaa1 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -99,7 +99,8 @@ SYM_CODE_START(primary_entry)
        cbz     x19, 0f
        adrp    x0, __idmap_text_start
        adr_l   x1, __idmap_text_end
-       bl      dcache_clean_poc
+       adr_l   x2, dcache_clean_poc
+       blr     x2
 0:     mov     x0, x19
        bl      init_kernel_el                  // w0=cpu_boot_mode
        mov     x20, x0
@@ -566,7 +567,8 @@ SYM_INNER_LABEL(init_el2, SYM_L_LOCAL)
        cbz     x0, 0f
        adrp    x0, __hyp_idmap_text_start
        adr_l   x1, __hyp_text_end
-       bl      dcache_clean_poc
+       adr_l   x2, dcache_clean_poc
+       blr     x2
 0:
        mov_q   x0, HCR_HOST_NVHE_FLAGS
        msr     hcr_el2, x0