linux-kernel - Re: [PATCH] kbuild: clang: Support building UM with SUBARCH=i386

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202503040842.1177A1F15B@keescook>
Date: Tue, 4 Mar 2025 09:07:57 -0800
From: Kees Cook <kees@...nel.org>
To: Thomas Weißschuh <linux@...ssschuh.net>
Cc: Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <ndesaulniers@...gle.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Nicolas Schier <nicolas@...sle.eu>, llvm@...ts.linux.dev,
	linux-kbuild@...r.kernel.org, David Gow <davidgow@...gle.com>,
	linux-kernel@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: [PATCH] kbuild: clang: Support building UM with SUBARCH=i386

On Tue, Mar 04, 2025 at 03:51:19PM +0100, Thomas Weißschuh wrote:
> On 2025-03-04 11:25:36+0100, Nathan Chancellor wrote:
> > On Mon, Mar 03, 2025 at 11:29:58PM +0100, Thomas Weißschuh wrote:
> > > On 2025-03-03 13:52:41-0800, Kees Cook wrote:
> 
> <snip>
> 
> > > This is also what exists in tools/testing/selftests/lib.mk.
> > > Minus the missing CONFIG_FORTIFY_SOURCE on clang x86_32
> > > and a failure of overflow.DEFINE_FLEX_test (clang 19.1.7).
> > 
> > Does Kees's other patch resolve the second issue? It'll obviously fix
> > the first :P
> > 
> > https://lore.kernel.org/20250303214929.work.499-kees@kernel.org/
> 
> No, it doesn't.
> 
> Running tests with:
> $ .kunit/linux kunit.filter_glob=overflow.DEFINE_FLEX_test kunit.enable=1 mem=1G console=tty kunit_shutdown=halt
> [15:48:30] =================== overflow (1 subtest) ===================
> [15:48:30] # DEFINE_FLEX_test: EXPECTATION FAILED at lib/overflow_kunit.c:1200
> [15:48:30] Expected __builtin_dynamic_object_size(two_but_zero, 0) == expected_raw_size, but
> [15:48:30]     __builtin_dynamic_object_size(two_but_zero, 0) == 12 (0xc)
> [15:48:30]     expected_raw_size == 8 (0x8)
> [15:48:30] [FAILED] DEFINE_FLEX_test
> [15:48:30] # module: overflow_kunit
> [15:48:30] ==================== [FAILED] overflow =====================
> [15:48:30] ============================================================
> [15:48:30] Testing complete. Ran 1 tests: failed: 1
> [15:48:31] Elapsed time: 43.985s total, 0.001s configuring, 43.818s building, 0.133s running
> 
> If I force CONFIG_CC_HAS_COUNTED_BY=n then the test succeeds.
> Clang 19.1.7 from the Arch Linux repos.

I wasn't seeing with Clang 20 from git:
ClangBuiltLinux clang version 20.0.0git (git@...hub.com:llvm/llvm-project.git 72901fe19eb1e55d0ee1c380ab7a9f57d2f187c5)

But I do see the error with ToT Clang:
ClangBuiltLinux clang version 21.0.0git (git@...hub.com:llvm/llvm-project.git eee3db5421040cfc3eae6e92ed714650a6f741fa)

Clang 17.1: (does not support counted_by)

    # DEFINE_FLEX_test: missing counted_by
    # DEFINE_FLEX_test: sizeof(two_but_zero): 8
    # DEFINE_FLEX_test: __struct_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero->array): 4

Clang 19.1.1: (actually is _does_ support counted_by, but Linux disables it)

    # DEFINE_FLEX_test: missing counted_by
    # DEFINE_FLEX_test: sizeof(two_but_zero): 8
    # DEFINE_FLEX_test: __struct_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero->array): 4

GCC 13.3:

    # DEFINE_FLEX_test: missing counted_by
    # DEFINE_FLEX_test: sizeof(two_but_zero): 8
    # DEFINE_FLEX_test: __struct_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero->array): 4

Clang 21 (ToT):

    # DEFINE_FLEX_test: has counted_by
    # DEFINE_FLEX_test: sizeof(two_but_zero): 8
    # DEFINE_FLEX_test: __struct_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero->array): 0

GCC 15 (ToT):

    # DEFINE_FLEX_test: has counted_by
    # DEFINE_FLEX_test: sizeof(two_but_zero): 8
    # DEFINE_FLEX_test: __struct_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero): 12
    # DEFINE_FLEX_test: __member_size(two_but_zero->array): 0

It seems like the on-stack sizes with __bdos all agree now, regardless
of the used compiler features. It is only the array size calculation
that now gets masked by counted_by. (i.e. the stack size is overridden
by the zero "count" for the array elements.)

I'll send a fix for the test...

-- 
Kees Cook