linux-kernel - Re: [PATCH v2] kbuild: Strip runtime const RELA sections correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAMj1kXHfD=ZBgOBZpAB97i210N7vtHd2_UPbE_2oAmdMA3Ya9w@mail.gmail.com>
Date: Mon, 13 Jan 2025 16:09:35 +0100
From: Ard Biesheuvel <ardb@...nel.org>
To: Ron Economos <re@...z.net>
Cc: Ard Biesheuvel <ardb+git@...gle.com>, linux-kbuild@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Linus Torvalds <torvalds@...ux-foundation.org>, 
	Masahiro Yamada <masahiroy@...nel.org>, linux-riscv@...ts.infradead.org, 
	linux-s390@...r.kernel.org
Subject: Re: [PATCH v2] kbuild: Strip runtime const RELA sections correctly

On Mon, 13 Jan 2025 at 16:07, Ron Economos <re@...z.net> wrote:
>
> On 1/13/25 06:32, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@...nel.org>
> >
> > Due to the fact that runtime const ELF sections are named without a
> > leading period or double underscore, the RSTRIP logic that removes the
> > static RELA sections from vmlinux fails to identify them. This results
> > in a situation like below, where some sections that were supposed to get
> > removed are left behind.
> >
> >    [Nr] Name                              Type            Address          Off     Size   ES Flg Lk Inf Al
> >
> >    [58] runtime_shift_d_hash_shift        PROGBITS        ffffffff83500f50 2900f50 000014 00   A  0   0  1
> >    [59] .relaruntime_shift_d_hash_shift   RELA            0000000000000000 55b6f00 000078 18   I 70  58  8
> >    [60] runtime_ptr_dentry_hashtable      PROGBITS        ffffffff83500f68 2900f68 000014 00   A  0   0  1
> >    [61] .relaruntime_ptr_dentry_hashtable RELA            0000000000000000 55b6f78 000078 18   I 70  60  8
> >    [62] runtime_ptr_USER_PTR_MAX          PROGBITS        ffffffff83500f80 2900f80 000238 00   A  0   0  1
> >    [63] .relaruntime_ptr_USER_PTR_MAX     RELA            0000000000000000 55b6ff0 000d50 18   I 70  62  8
> >
> > So tweak the match expression to strip all sections starting with .rel.
> > While at it, consolidate the logic used by RISC-V, s390 and x86 into a
> > single shared Makefile library command.
> >
> > Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> > Cc: Masahiro Yamada <masahiroy@...nel.org>
> > Cc: linux-riscv@...ts.infradead.org
> > Cc: linux-s390@...r.kernel.org
> > Link: https://lore.kernel.org/all/CAHk-=wjk3ynjomNvFN8jf9A1k=qSc=JFF591W00uXj-qqNUxPQ@mail.gmail.com/
> > Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
> > ---
> > v2: add missing include of scripts/Makefile.lib
> >
> >   arch/riscv/Makefile.postlink | 10 ++--------
> >   arch/s390/Makefile.postlink  |  6 +-----
> >   arch/x86/Makefile.postlink   |  6 +-----
> >   scripts/Makefile.lib         |  3 +++
> >   4 files changed, 7 insertions(+), 18 deletions(-)
> >
> > diff --git a/arch/riscv/Makefile.postlink b/arch/riscv/Makefile.postlink
> > index 829b9abc91f6..750d2784f69e 100644
> > --- a/arch/riscv/Makefile.postlink
> > +++ b/arch/riscv/Makefile.postlink
> > @@ -10,6 +10,7 @@ __archpost:
> >
> >   -include include/config/auto.conf
> >   include $(srctree)/scripts/Kbuild.include
> > +include $(srctree)/scripts/Makefile.lib
> >
> >   quiet_cmd_relocs_check = CHKREL  $@
> >   cmd_relocs_check =                                                  \
> > @@ -19,13 +20,6 @@ ifdef CONFIG_RELOCATABLE
> >   quiet_cmd_cp_vmlinux_relocs = CPREL   vmlinux.relocs
> >   cmd_cp_vmlinux_relocs = cp vmlinux vmlinux.relocs
> >
> > -quiet_cmd_relocs_strip = STRIPREL $@
> > -cmd_relocs_strip = $(OBJCOPY)   --remove-section='.rel.*'       \
> > -                                --remove-section='.rel__*'      \
> > -                                --remove-section='.rela.*'      \
> > -                                --remove-section='.rela__*' $@
> > -endif
> > -
> >   # `@...e` prevents complaint when there is nothing to be done
> >
> >   vmlinux: FORCE
> > @@ -33,7 +27,7 @@ vmlinux: FORCE
> >   ifdef CONFIG_RELOCATABLE
> >       $(call if_changed,relocs_check)
> >       $(call if_changed,cp_vmlinux_relocs)
> > -     $(call if_changed,relocs_strip)
> > +     $(call if_changed,strip_relocs)
> >   endif
> >
> >   clean:
> > diff --git a/arch/s390/Makefile.postlink b/arch/s390/Makefile.postlink
> > index df82f5410769..1ae5478cd6ac 100644
> > --- a/arch/s390/Makefile.postlink
> > +++ b/arch/s390/Makefile.postlink
> > @@ -11,6 +11,7 @@ __archpost:
> >
> >   -include include/config/auto.conf
> >   include $(srctree)/scripts/Kbuild.include
> > +include $(srctree)/scripts/Makefile.lib
> >
> >   CMD_RELOCS=arch/s390/tools/relocs
> >   OUT_RELOCS = arch/s390/boot
> > @@ -19,11 +20,6 @@ quiet_cmd_relocs = RELOCS  $(OUT_RELOCS)/relocs.S
> >       mkdir -p $(OUT_RELOCS); \
> >       $(CMD_RELOCS) $@ > $(OUT_RELOCS)/relocs.S
> >
> > -quiet_cmd_strip_relocs = RSTRIP  $@
> > -      cmd_strip_relocs = \
> > -     $(OBJCOPY) --remove-section='.rel.*' --remove-section='.rel__*' \
> > -                --remove-section='.rela.*' --remove-section='.rela__*' $@
> > -
> >   vmlinux: FORCE
> >       $(call cmd,relocs)
> >       $(call cmd,strip_relocs)
> > diff --git a/arch/x86/Makefile.postlink b/arch/x86/Makefile.postlink
> > index fef2e977cc7d..8b8a68162c94 100644
> > --- a/arch/x86/Makefile.postlink
> > +++ b/arch/x86/Makefile.postlink
> > @@ -11,6 +11,7 @@ __archpost:
> >
> >   -include include/config/auto.conf
> >   include $(srctree)/scripts/Kbuild.include
> > +include $(srctree)/scripts/Makefile.lib
> >
> >   CMD_RELOCS = arch/x86/tools/relocs
> >   OUT_RELOCS = arch/x86/boot/compressed
> > @@ -20,11 +21,6 @@ quiet_cmd_relocs = RELOCS  $(OUT_RELOCS)/$@...locs
> >       $(CMD_RELOCS) $@ > $(OUT_RELOCS)/$@...locs; \
> >       $(CMD_RELOCS) --abs-relocs $@
> >
> > -quiet_cmd_strip_relocs = RSTRIP  $@
> > -      cmd_strip_relocs = \
> > -     $(OBJCOPY) --remove-section='.rel.*' --remove-section='.rel__*' \
> > -                --remove-section='.rela.*' --remove-section='.rela__*' $@
> > -
> >   # `@...e` prevents complaint when there is nothing to be done
> >
> >   vmlinux: FORCE
> > diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
> > index 7395200538da..f604f51d23ca 100644
> > --- a/scripts/Makefile.lib
> > +++ b/scripts/Makefile.lib
> > @@ -374,6 +374,9 @@ quiet_cmd_ar = AR      $@
> >   quiet_cmd_objcopy = OBJCOPY $@
> >   cmd_objcopy = $(OBJCOPY) $(OBJCOPYFLAGS) $(OBJCOPYFLAGS_$(@F)) $< $@
> >
> > +quiet_cmd_strip_relocs = RSTRIP  $@
> > +cmd_strip_relocs = $(OBJCOPY) --remove-section='.rel*' $@
> > +
> >   # Gzip
> >   # ---------------------------------------------------------------------------
> >
>
> Fails on RISC-V with:
>
>    LD      vmlinux
>    NM      System.map
>    SORTTAB vmlinux
> arch/riscv/Makefile.postlink:41: *** missing 'endif'.  Stop.
> make[2]: *** [scripts/Makefile.vmlinux:34: vmlinux] Error 2
> make[2]: *** Deleting file 'vmlinux'
> make[1]: *** [/home/ubuntu/xfer/linux/Makefile:1167: vmlinux] Error 2
> make: *** [Makefile:224: __sub-make] Error 2
> Command exited with non-zero status 2
>
> I think you need to put that deleted "endif" back in.
>

Yeah, sorry about that, and thanks for testing.