linux-kernel - [PATCH] compiler_types: Provide __no_kstack_erase to disable coverage only on Clang

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250729224325.work.019-kees@kernel.org>
Date: Tue, 29 Jul 2025 15:43:33 -0700
From: Kees Cook <kees@...nel.org>
To: Linus Torvalds <torvalds@...uxfoundation.org>
Cc: Kees Cook <kees@...nel.org>,
	kernel test robot <lkp@...el.com>,
	syzbot+5245cb609175fb6e8122@...kaller.appspotmail.com,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Borislav Petkov <bp@...en8.de>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	x86@...nel.org,
	"H. Peter Anvin" <hpa@...or.com>,
	Ard Biesheuvel <ardb@...nel.org>,
	Marco Elver <elver@...gle.com>,
	Hou Wenlong <houwenlong.hwl@...group.com>,
	"Kirill A . Shutemov" <kas@...nel.org>,
	Miguel Ojeda <ojeda@...nel.org>,
	Nathan Chancellor <nathan@...nel.org>,
	Przemek Kitszel <przemyslaw.kitszel@...el.com>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Masahiro Yamada <masahiroy@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Wei Yang <richard.weiyang@...il.com>,
	Sami Tolvanen <samitolvanen@...gle.com>,
	Arnd Bergmann <arnd@...db.de>,
	Christophe Leroy <christophe.leroy@...roup.eu>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	Michael Kelley <mhklinux@...look.com>,
	Marc Herbert <Marc.Herbert@...ux.intel.com>,
	Yafang Shao <laoar.shao@...il.com>,
	Uros Bizjak <ubizjak@...il.com>,
	Jan Hendrik Farr <kernel@...rr.cc>,
	linux-kernel@...r.kernel.org,
	llvm@...ts.linux.dev,
	linux-hardening@...r.kernel.org
Subject: [PATCH] compiler_types: Provide __no_kstack_erase to disable coverage only on Clang

In order to support Clang's stack depth tracking (for Linux's kstack_erase
feature), the coverage sanitizer needed to be disabled for __init (and
__head) section code. Doing this universally (i.e. for GCC too), created
a number of unexpected problems, ranging from changes to inlining logic
to failures to DCE code on earlier GCC versions.

Since this change is only needed for Clang, specialize it so that GCC
doesn't see the change as it isn't needed there (the GCC implementation
of kstack_erase uses a GCC plugin that removes stack depth tracking
instrumentation from __init sections during a late pass in the IR).

Successful build and boot tested with GCC 12 and Clang 22.

Fixes: 381a38ea53d2 ("init.h: Disable sanitizer coverage for __init and __head")
Reported-by: kernel test robot <lkp@...el.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202507270258.neWuiXLd-lkp@intel.com/
Reported-by: syzbot+5245cb609175fb6e8122@...kaller.appspotmail.com
Closes: https://lore.kernel.org/all/6888d004.a00a0220.26d0e1.0004.GAE@google.com/
Signed-off-by: Kees Cook <kees@...nel.org>
---
Cc: Linus Torvalds <torvalds@...uxfoundation.org>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: Borislav Petkov <bp@...en8.de>
Cc: Dave Hansen <dave.hansen@...ux.intel.com>
Cc: <x86@...nel.org>
Cc: "H. Peter Anvin" <hpa@...or.com>
Cc: Ard Biesheuvel <ardb@...nel.org>
Cc: Marco Elver <elver@...gle.com>
Cc: Hou Wenlong <houwenlong.hwl@...group.com>
Cc: Kirill A. Shutemov <kas@...nel.org>
Cc: Miguel Ojeda <ojeda@...nel.org>
Cc: Nathan Chancellor <nathan@...nel.org>
Cc: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: Masahiro Yamada <masahiroy@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Wei Yang <richard.weiyang@...il.com>
Cc: Sami Tolvanen <samitolvanen@...gle.com>
Cc: Arnd Bergmann <arnd@...db.de>
Cc: Christophe Leroy <christophe.leroy@...roup.eu>
---
 arch/x86/include/asm/init.h    | 2 +-
 include/linux/compiler_types.h | 7 +++++++
 include/linux/init.h           | 2 +-
 3 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 6bfdaeddbae8..5a68e9db6518 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -5,7 +5,7 @@
 #if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
 #define __head	__section(".head.text") __no_sanitize_undefined __no_stack_protector
 #else
-#define __head	__section(".head.text") __no_sanitize_undefined __no_sanitize_coverage
+#define __head	__section(".head.text") __no_sanitize_undefined __no_kstack_erase
 #endif
 
 struct x86_mapping_info {
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index 2b77d12e07b2..89e2c01fc8b1 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -378,6 +378,13 @@ struct ftrace_likely_data {
 # define __signed_wrap
 #endif
 
+/* GCC does not like splitting sanitizer coverage across section inlines */
+#ifdef CC_IS_CLANG
+#define __no_kstack_erase	__no_sanitize_coverage
+#else
+#define __no_kstack_erase
+#endif
+
 /* Section for code which can't be instrumented at all */
 #define __noinstr_section(section)					\
 	noinline notrace __attribute((__section__(section)))		\
diff --git a/include/linux/init.h b/include/linux/init.h
index c65a050d52a7..a60d32d227ee 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -51,7 +51,7 @@
    discard it in modules) */
 #define __init		__section(".init.text") __cold __latent_entropy	\
 						__noinitretpoline	\
-						__no_sanitize_coverage
+						__no_kstack_erase
 #define __initdata	__section(".init.data")
 #define __initconst	__section(".init.rodata")
 #define __exitdata	__section(".exit.data")
-- 
2.34.1