linux-kernel - Re: [PATCH v2 8/8] tools/nolibc: x86

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 23 Mar 2023 21:19:48 +0100
From:   Willy Tarreau <w@....eu>
To:     Thomas Weißschuh <linux@...ssschuh.net>
Cc:     Shuah Khan <shuah@...nel.org>, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org
Subject: Re: [PATCH v2 8/8] tools/nolibc: x86_64: add stackprotector support

Hi Thomas,

On Mon, Mar 20, 2023 at 03:41:08PM +0000, Thomas Weißschuh wrote:
> Enable the new stackprotector support for x86_64.
(...)
> diff --git a/tools/testing/selftests/nolibc/Makefile b/tools/testing/selftests/nolibc/Makefile
> index 8f069ebdd124..543555f4cbdc 100644
> --- a/tools/testing/selftests/nolibc/Makefile
> +++ b/tools/testing/selftests/nolibc/Makefile
> @@ -80,6 +80,8 @@ CFLAGS_STACKPROTECTOR = -DNOLIBC_STACKPROTECTOR \
>  			$(call cc-option,-mstack-protector-guard=global) \
>  			$(call cc-option,-fstack-protector-all)
>  CFLAGS_i386 = $(CFLAGS_STACKPROTECTOR)
> +CFLAGS_x86_64 = $(CFLAGS_STACKPROTECTOR)
> +CFLAGS_x86 = $(CFLAGS_STACKPROTECTOR)
>  CFLAGS_s390 = -m64
>  CFLAGS  ?= -Os -fno-ident -fno-asynchronous-unwind-tables \
>  		$(call cc-option,-fno-stack-protector) \

This change is making it almost impossible for me to pass external CFLAGS
without forcefully disabling the automatic detection of stackprot. I need
to do it for some archs (e.g. "-march=armv5t -mthumb") or even to change
optimization levels.

I figured that the simplest way to recover that functionality for me
consists in using a dedicated variable to assign stack protector per
supported architecure and concatenating it to the per-arch CFLAGS like
this:

  diff --git a/tools/testing/selftests/nolibc/Makefile b/tools/testing/selftests/nolibc/Makefile
  index 543555f4cbdc..bbce57420465 100644
  --- a/tools/testing/selftests/nolibc/Makefile
  +++ b/tools/testing/selftests/nolibc/Makefile
  @@ -79,13 +79,13 @@ endif
   CFLAGS_STACKPROTECTOR = -DNOLIBC_STACKPROTECTOR \
                          $(call cc-option,-mstack-protector-guard=global) \
                          $(call cc-option,-fstack-protector-all)
  -CFLAGS_i386 = $(CFLAGS_STACKPROTECTOR)
  -CFLAGS_x86_64 = $(CFLAGS_STACKPROTECTOR)
  -CFLAGS_x86 = $(CFLAGS_STACKPROTECTOR)
  +CFLAGS_STKP_i386 = $(CFLAGS_STACKPROTECTOR)
  +CFLAGS_STKP_x86_64 = $(CFLAGS_STACKPROTECTOR)
  +CFLAGS_STKP_x86 = $(CFLAGS_STACKPROTECTOR)
   CFLAGS_s390 = -m64
   CFLAGS  ?= -Os -fno-ident -fno-asynchronous-unwind-tables \
                  $(call cc-option,-fno-stack-protector) \
  -               $(CFLAGS_$(ARCH))
  +               $(CFLAGS_STKP_$(ARCH)) $(CFLAGS_$(ARCH))
   LDFLAGS := -s
   
   help:

And now with this it works again for me on all archs, with all of them
showing "SKIPPED" for the -fstackprotector line except i386/x86_64 which
show "OK".

Are you OK with this approach ? And if so, do you want to respin it or
do you want me to retrofit it into your 3 patches that introduce this
change (it's easy enough so I really don't care) ?

Thanks!
Willy