linux-kernel - Re: [PATCH v3] kbuild: Strip runtime const RELA sections correctly

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAMj1kXE4DJnwFejNWQu784GvyJO=aGNrzuLjSxiowX_e7nW8QA@mail.gmail.com>
Date: Sun, 19 Jan 2025 18:15:22 +0100
From: Ard Biesheuvel <ardb@...nel.org>
To: Charlie Jenkins <charlie@...osinc.com>
Cc: Ard Biesheuvel <ardb+git@...gle.com>, linux-kbuild@...r.kernel.org, 
	linux-kernel@...r.kernel.org, Linus Torvalds <torvalds@...ux-foundation.org>, 
	Masahiro Yamada <masahiroy@...nel.org>, Alexandre Ghiti <alexghiti@...osinc.com>, 
	linux-riscv@...ts.infradead.org, linux-s390@...r.kernel.org, 
	Ron Economos <re@...z.net>
Subject: Re: [PATCH v3] kbuild: Strip runtime const RELA sections correctly

On Thu, 16 Jan 2025 at 23:02, Charlie Jenkins <charlie@...osinc.com> wrote:
>
> On Mon, Jan 13, 2025 at 04:53:07PM +0100, Ard Biesheuvel wrote:
> > From: Ard Biesheuvel <ardb@...nel.org>
> >
> > Due to the fact that runtime const ELF sections are named without a
> > leading period or double underscore, the RSTRIP logic that removes the
> > static RELA sections from vmlinux fails to identify them. This results
> > in a situation like below, where some sections that were supposed to get
> > removed are left behind.
> >
> >   [Nr] Name                              Type            Address          Off     Size   ES Flg Lk Inf Al
> >
> >   [58] runtime_shift_d_hash_shift        PROGBITS        ffffffff83500f50 2900f50 000014 00   A  0   0  1
> >   [59] .relaruntime_shift_d_hash_shift   RELA            0000000000000000 55b6f00 000078 18   I 70  58  8
> >   [60] runtime_ptr_dentry_hashtable      PROGBITS        ffffffff83500f68 2900f68 000014 00   A  0   0  1
> >   [61] .relaruntime_ptr_dentry_hashtable RELA            0000000000000000 55b6f78 000078 18   I 70  60  8
> >   [62] runtime_ptr_USER_PTR_MAX          PROGBITS        ffffffff83500f80 2900f80 000238 00   A  0   0  1
> >   [63] .relaruntime_ptr_USER_PTR_MAX     RELA            0000000000000000 55b6ff0 000d50 18   I 70  62  8
> >
> > So tweak the match expression to strip all sections starting with .rel.
> > While at it, consolidate the logic used by RISC-V, s390 and x86 into a
> > single shared Makefile library command.
> >
> > Cc: Linus Torvalds <torvalds@...ux-foundation.org>
> > Cc: Masahiro Yamada <masahiroy@...nel.org>
> > Cc: linux-riscv@...ts.infradead.org
> > Cc: linux-s390@...r.kernel.org
> > Cc: Ron Economos <re@...z.net>
> > Link: https://lore.kernel.org/all/CAHk-=wjk3ynjomNvFN8jf9A1k=qSc=JFF591W00uXj-qqNUxPQ@mail.gmail.com/
> > Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
> > ---
> > v3: put back missing 'endif' to fix the RISC-V build
> > v2: add missing include of scripts/Makefile.lib
> >
> >  arch/riscv/Makefile.postlink |  8 ++------
> >  arch/s390/Makefile.postlink  |  6 +-----
> >  arch/x86/Makefile.postlink   |  6 +-----
> >  scripts/Makefile.lib         |  3 +++
> >  4 files changed, 7 insertions(+), 18 deletions(-)
> >
> > diff --git a/arch/riscv/Makefile.postlink b/arch/riscv/Makefile.postlink
> > index 829b9abc91f6..750d2784f69e 100644
> > --- a/arch/riscv/Makefile.postlink
> > +++ b/arch/riscv/Makefile.postlink
>
> When I compile x86 as relocatable I see the problem that you are fixing
> here, but I don't see it on riscv.

That is because riscv does not yet support optimized runtime
constants. Only arm64, s390 and x86 implement this today but I'd
expect other architectures to follow suit.

> It's probably better to keep around
> this code for riscv, but I don't think it even needs this stripping? I
> am adding Alex since he added this for riscv.
>

If vmlinux is linked with --emit-relocs, the stripping is probably
necessary, or you get a lot of metadata in vmlinux that is not needed
for debugging.

> Anyways this works as expected:
>
> Reviewed-by: Charlie Jenkins <charlie@...osinc.com>
> Tested-by: Charlie Jenkins <charlie@...osinc.com>
>

Thanks.