linux-kernel - Re: [PATCH v4] Makefile.compiler: replace cc-ifversion with compiler-specific macros

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAKwvOdmOhuBJ0f1ZpmeP-jSg6cN=v3_oHjvnhUXc4XHp7nY9hg@mail.gmail.com>
Date:   Mon, 22 May 2023 13:16:09 -0700
From:   Nick Desaulniers <ndesaulniers@...gle.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Maksim Panchenko <maks@...a.com>,
        Ricardo Cañuelo <ricardo.canuelo@...labora.com>,
        Shreeya Patel <shreeya.patel@...labora.com>,
        Michal Marek <michal.lkml@...kovi.net>,
        Masahiro Yamada <masahiroy@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        clang-built-linux <llvm@...ts.linux.dev>,
        Bill Wendling <morbo@...gle.com>,
        Nathan Chancellor <nathan@...nel.org>,
        regressions@...ts.linux.dev,
        "gustavo.padovan@...labora.com" <gustavo.padovan@...labora.com>,
        Guillaume Charles Tucker <guillaume.tucker@...labora.com>,
        denys.f@...labora.com, kernelci@...ts.linux.dev
Subject: Re: [PATCH v4] Makefile.compiler: replace cc-ifversion with
 compiler-specific macros

On Mon, May 22, 2023 at 1:01 PM Greg KH <gregkh@...uxfoundation.org> wrote:
>
> On Mon, May 22, 2023 at 12:52:13PM -0700, Nick Desaulniers wrote:
> > On Mon, May 22, 2023 at 9:52 AM Greg KH <gregkh@...uxfoundation.org> wrote:
> > >
> > > On Mon, May 22, 2023 at 12:09:34PM +0200, Ricardo Cañuelo wrote:
> > > > On vie, may 19 2023 at 08:57:24, Nick Desaulniers <ndesaulniers@...gle.com> wrote:
> > > > > It could be; if the link order was changed, it's possible that this
> > > > > target may be hitting something along the lines of:
> > > > > https://isocpp.org/wiki/faq/ctors#static-init-order i.e. the "static
> > > > > initialization order fiasco"
> > > > >
> > > > > I'm struggling to think of how this appears in C codebases, but I
> > > > > swear years ago I had a discussion with GKH (maybe?) about this. I
> > > > > think I was playing with converting Kbuild to use Ninja rather than
> > > > > Make; the resulting kernel image wouldn't boot because I had modified
> > > > > the order the object files were linked in.  If you were to randomly
> > > > > shuffle the object files in the kernel, I recall some hazard that may
> > > > > prevent boot.
> > > >
> > > > I thought that was specifically a C++ problem? But then again, the
> > > > kernel docs explicitly say that the ordering of obj-y goals in kbuild is
> > > > significant in some instances [1]:
> > >
> > > Yes, it matters, you can not change it.  If you do, systems will break.
> > > It is the only way we have of properly ordering our init calls within
> > > the same "level".
> >
> > Ah, right it was the initcall ordering. Thanks for the reminder.
> >
> > (There's a joke in there similar to the use of regexes to solve a
> > problem resulting in two new problems; initcalls have levels for
> > ordering, but we still have (unexpressed) dependencies between calls
> > of the same level; brittle!).
>
> No, the dependencies are explicitly expressed with the linker order.  So

I don't consider that "explicit."

The link order of object files does not express what symbols (if any)
are initcalls which are dependent on other symbols/initcalls from
which object file.

> it's not brittle, but rather very deterministic.

Brittle != non-deterministic.

We now have implicit dependencies between some init calls, but not all.

Given two initcalls, are you confident that you could tell which must
run before the other, if there is even such a dependency?

It prevents us from reordering symbol layout for performance (or
security via FGKASLR), safely.  If such dependencies were *explicit*,
we could do so safely since we'd have information about which
initcalls are dependencies or not.

The implicit nature of such dependencies is thus what I would consider brittle.

Hopefully initcall ordering related changes isn't the root cause of
the boot failure reported here, lest that lend more evidence to my
claim.

>
> When linker order didn't work for all sorts of things, we added
> different levels, but due to the huge number of init calls, of course
> can not give each one their own level.
>
> It's always been this way with Linux, nothing new here at all :)

:^)

>
> thanks,
>
> greg k-h



-- 
Thanks,
~Nick Desaulniers