linux-kernel - Re: [syzbot] upstream build error (23)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87cy9ikcwh.ffs@tglx>
Date: Tue, 29 Jul 2025 21:36:14 +0200
From: Thomas Gleixner <tglx@...utronix.de>
To: syzbot <syzbot+5245cb609175fb6e8122@...kaller.appspotmail.com>,
 bp@...en8.de, dave.hansen@...ux.intel.com, hpa@...or.com,
 linux-kernel@...r.kernel.org, mingo@...hat.com,
 syzkaller-bugs@...glegroups.com, x86@...nel.org
Cc: Linus Torvalds <torvalds@...uxfoundation.org>
Subject: Re: [syzbot] upstream build error (23)

On Tue, Jul 29 2025 at 06:43, syzbot wrote:
> syzbot found the following issue on:
>
> HEAD commit:    86aa72182095 Merge tag 'chrome-platform-v6.17' of git://gi..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=171674a2580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=3816ffa0a2bab886
> dashboard link: https://syzkaller.appspot.com/bug?extid=5245cb609175fb6e8122
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+5245cb609175fb6e8122@...kaller.appspotmail.com
>
> arch/x86/kernel/setup.c:1251: undefined reference to `efi_mem_type'
> ld: arch/x86/kernel/setup.c:987: undefined reference to `efi_init'

Cute. So the code has:

        if (efi_enabled(EFI_BOOT))
                efi_init();

in the CONFIG_EFI=n case:

static inline bool efi_enabled(int feature)
{
        return false;
}

efi_init() has an unconditional forward declaration:

extern void efi_init (void);

This has been the case forever and has been optimized out because
efi_enabled() evaluates to a constant.

I haven't checked which sanitizer option causes GCC to compile this
into:

00000000000000d0 <efi_enabled.constprop.0>:
}
extern void efi_find_mirror(void);
#else
static inline bool efi_enabled(int feature)
{
        return false;
  d0:   e8 00 00 00 00          call   d5 <efi_enabled.constprop.0+0x5>
}
  d5:   31 c0                   xor    %eax,%eax
  d7:   e9 00 00 00 00          jmp    dc <efi_enabled.constprop.0+0xc>

and to keep the call for efi_init() as a symbol for the linker to
resolve, which obviously fails.

If I change the efi_enabled() stub to __always_inline, it's optimized
out.

Disabling CONFIG_KCOV_INSTRUMENT_ALL makes it go away. So GCC confuses
the optimizer when CONFIG_KCOV_INSTRUMENT_ALL is on.

The kernel is full of such inline (not __always_inline) stub
conditionals which evaluate to a constant....

Thanks,

        tglx