linux-kernel - Re: [PATCH 5.15 v2 1/5] arch: fix broken BuildID for arm64 and riscv

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 28 Feb 2023 09:58:16 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Tom Saeger <tom.saeger@...cle.com>
Cc:     Sasha Levin <sashal@...nel.org>,
        Naresh Kamboju <naresh.kamboju@...aro.org>,
        John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>,
        Rich Felker <dalias@...c.org>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Ard Biesheuvel <ardb@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Dennis Gilmore <dennis@...il.us>,
        Palmer Dabbelt <palmer@...osinc.com>,
        Arnd Bergmann <arnd@...db.de>,
        Andrew Morton <akpm@...ux-foundation.org>,
        stable@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-arch@...r.kernel.org, linux-arm-kernel@...ts.infradead.org,
        linux-riscv@...ts.infradead.org, linuxppc-dev@...ts.ozlabs.org,
        linux-s390@...r.kernel.org, linux-sh@...r.kernel.org
Subject: Re: [PATCH 5.15 v2 1/5] arch: fix broken BuildID for arm64 and riscv

On Thu, Feb 23, 2023 at 08:47:24PM -0600, Tom Saeger wrote:
> On Thu, Feb 23, 2023 at 11:53:42AM -0600, Tom Saeger wrote:
> > On Thu, Feb 23, 2023 at 10:51:45AM +0100, Greg Kroah-Hartman wrote:
> > > On Fri, Feb 10, 2023 at 01:18:40PM -0700, Tom Saeger wrote:
> > > > From: Masahiro Yamada <masahiroy@...nel.org>
> > > > 
> > > > commit 99cb0d917ffa1ab628bb67364ca9b162c07699b1 upstream.
> > > > 
> > > > Dennis Gilmore reports that the BuildID is missing in the arm64 vmlinux
> > > > since commit 994b7ac1697b ("arm64: remove special treatment for the
> > > > link order of head.o").
> > > > 
> > > > The issue is that the type of .notes section, which contains the BuildID,
> > > > changed from NOTES to PROGBITS.
> > > > 
> > > > Ard Biesheuvel figured out that whichever object gets linked first gets
> > > > to decide the type of a section. The PROGBITS type is the result of the
> > > > compiler emitting .note.GNU-stack as PROGBITS rather than NOTE.
> > > > 
> > > > While Ard provided a fix for arm64, I want to fix this globally because
> > > > the same issue is happening on riscv since commit 2348e6bf4421 ("riscv:
> > > > remove special treatment for the link order of head.o"). This problem
> > > > will happen in general for other architectures if they start to drop
> > > > unneeded entries from scripts/head-object-list.txt.
> > > > 
> > > > Discard .note.GNU-stack in include/asm-generic/vmlinux.lds.h.
> > > > 
> > > > Link: https://lore.kernel.org/lkml/CAABkxwuQoz1CTbyb57n0ZX65eSYiTonFCU8-LCQc=74D=xE=rA@mail.gmail.com/
> > > > Fixes: 994b7ac1697b ("arm64: remove special treatment for the link order of head.o")
> > > > Fixes: 2348e6bf4421 ("riscv: remove special treatment for the link order of head.o")
> 
> Greg, how about something like this tacked onto backport of this commit?
> 
> [Tom: stable backport 5.15.y, 5.10.y, 5.4.y]
> 
> Though the above "Fixes:" commits are not in this kernel, the conditions
> which lead to a missing Build ID in arm64 vmlinux are similar.
> 
> Evidence points to these conditions:
> 1. ld version > 2.36 (exact binutils commit documented in a494398bde27)
> 2. first object which gets linked (head.o) has a PROGBITS .note.GNU-stack segment
> 
> These conditions can be observed when:
> - 5.15.60+ OR 5.10.136+ OR 5.4.210+
> - AND ld version > 2.36
> - AND arch=arm64
> - AND CONFIG_MODVERSIONS=y
> 
> This was previously bisected to the stable backport of 0d362be5b142.
> Follow-up experiments were discussed here: https://lore.kernel.org/all/20221221235413.xaisboqmr7dkqwn6@oracle.com/ 
> which strongly hints at condition 2.
> 
> 
> > > 
> > > Why are we adding a commit to 5.15.y that fixes an issue that only
> > > showed up in 6.1.y?
> 
> If you approve - I'll send v3 for 5.15, 5.10, and 5.4 (with style fixes).

That would make more sense, thanks.

greg k-h