mbox series

[v7,0/5] Warn on orphan section placement

Message ID 20200902025347.2504702-1-keescook@chromium.org (mailing list archive)
Headers show
Series Warn on orphan section placement | expand

Message

Kees Cook Sept. 2, 2020, 2:53 a.m. UTC
Hi Ingo,

The ever-shortening series. ;) Here is "v7", which is just the remaining
Makefile changes to enable orphan section warnings, now updated to
include ld-option calls.

Thanks for getting this all into -tip!

-Kees

v6: https://lore.kernel.org/lkml/20200821194310.3089815-1-keescook@chromium.org/
v5: https://lore.kernel.org/lkml/20200731230820.1742553-1-keescook@chromium.org/
v4: https://lore.kernel.org/lkml/20200629061840.4065483-1-keescook@chromium.org/
v3: https://lore.kernel.org/lkml/20200624014940.1204448-1-keescook@chromium.org/
v2: https://lore.kernel.org/lkml/20200622205815.2988115-1-keescook@chromium.org/
v1: https://lore.kernel.org/lkml/20200228002244.15240-1-keescook@chromium.org/

Kees Cook (5):
  arm64/build: Warn on orphan section placement
  arm/build: Warn on orphan section placement
  arm/boot: Warn on orphan section placement
  x86/build: Warn on orphan section placement
  x86/boot/compressed: Warn on orphan section placement

 arch/arm/Makefile                 | 4 ++++
 arch/arm/boot/compressed/Makefile | 2 ++
 arch/arm64/Makefile               | 4 ++++
 arch/x86/Makefile                 | 4 ++++
 arch/x86/boot/compressed/Makefile | 1 +
 5 files changed, 15 insertions(+)

Comments

Nick Desaulniers Sept. 2, 2020, 7:04 p.m. UTC | #1
On Tue, Sep 1, 2020 at 7:53 PM Kees Cook <keescook@chromium.org> wrote:
>
> Hi Ingo,
>
> The ever-shortening series. ;) Here is "v7", which is just the remaining
> Makefile changes to enable orphan section warnings, now updated to
> include ld-option calls.
>
> Thanks for getting this all into -tip!

For the series,
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>

As the recent ppc vdso boogaloo exposed, what about the vdsos?
* arch/x86/entry/vdso/Makefile
* arch/arm/vdso/Makefile
* arch/arm64/kernel/vdso/Makefile
* arch/arm64/kernel/vdso32/Makefile

>
> -Kees
>
> v6: https://lore.kernel.org/lkml/20200821194310.3089815-1-keescook@chromium.org/
> v5: https://lore.kernel.org/lkml/20200731230820.1742553-1-keescook@chromium.org/
> v4: https://lore.kernel.org/lkml/20200629061840.4065483-1-keescook@chromium.org/
> v3: https://lore.kernel.org/lkml/20200624014940.1204448-1-keescook@chromium.org/
> v2: https://lore.kernel.org/lkml/20200622205815.2988115-1-keescook@chromium.org/
> v1: https://lore.kernel.org/lkml/20200228002244.15240-1-keescook@chromium.org/
>
> Kees Cook (5):
>   arm64/build: Warn on orphan section placement
>   arm/build: Warn on orphan section placement
>   arm/boot: Warn on orphan section placement
>   x86/build: Warn on orphan section placement
>   x86/boot/compressed: Warn on orphan section placement
>
>  arch/arm/Makefile                 | 4 ++++
>  arch/arm/boot/compressed/Makefile | 2 ++
>  arch/arm64/Makefile               | 4 ++++
>  arch/x86/Makefile                 | 4 ++++
>  arch/x86/boot/compressed/Makefile | 1 +
>  5 files changed, 15 insertions(+)
>
> --
> 2.25.1
>
Ingo Molnar Sept. 4, 2020, 5:58 a.m. UTC | #2
* Nick Desaulniers <ndesaulniers@google.com> wrote:

> On Tue, Sep 1, 2020 at 7:53 PM Kees Cook <keescook@chromium.org> wrote:
> >
> > Hi Ingo,
> >
> > The ever-shortening series. ;) Here is "v7", which is just the remaining
> > Makefile changes to enable orphan section warnings, now updated to
> > include ld-option calls.
> >
> > Thanks for getting this all into -tip!
> 
> For the series,
> Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
> 
> As the recent ppc vdso boogaloo exposed, what about the vdsos?
> * arch/x86/entry/vdso/Makefile
> * arch/arm/vdso/Makefile
> * arch/arm64/kernel/vdso/Makefile
> * arch/arm64/kernel/vdso32/Makefile

Kees, will these patches DTRT for the vDSO builds? I will be unable to test 
these patches on that old system until tomorrow the earliest.

I'm keeping these latest changes in WIP.core/build for now.

Thanks,

	Ingo
Kees Cook Sept. 4, 2020, 6:20 p.m. UTC | #3
On Fri, Sep 04, 2020 at 07:58:25AM +0200, Ingo Molnar wrote:
> 
> * Nick Desaulniers <ndesaulniers@google.com> wrote:
> 
> > On Tue, Sep 1, 2020 at 7:53 PM Kees Cook <keescook@chromium.org> wrote:
> > >
> > > Hi Ingo,
> > >
> > > The ever-shortening series. ;) Here is "v7", which is just the remaining
> > > Makefile changes to enable orphan section warnings, now updated to
> > > include ld-option calls.
> > >
> > > Thanks for getting this all into -tip!
> > 
> > For the series,
> > Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
> > 
> > As the recent ppc vdso boogaloo exposed, what about the vdsos?
> > * arch/x86/entry/vdso/Makefile
> > * arch/arm/vdso/Makefile
> > * arch/arm64/kernel/vdso/Makefile
> > * arch/arm64/kernel/vdso32/Makefile
> 
> Kees, will these patches DTRT for the vDSO builds? I will be unable to test 
> these patches on that old system until tomorrow the earliest.

I would like to see VDSO done next, but it's entirely separate from
this series. This series only touches the core kernel build (i.e. via the
interactions with scripts/link-vmlinux.sh) or the boot stubs. So there
is no impact on VDSO linking.

> I'm keeping these latest changes in WIP.core/build for now.

They should be safe to land in -next, which is important so we can shake
out any other sneaky sections that all our existing testing hasn't
found. :)
Ingo Molnar Sept. 6, 2020, 7:24 a.m. UTC | #4
* Kees Cook <keescook@chromium.org> wrote:

> On Fri, Sep 04, 2020 at 07:58:25AM +0200, Ingo Molnar wrote:
> > 
> > * Nick Desaulniers <ndesaulniers@google.com> wrote:
> > 
> > > On Tue, Sep 1, 2020 at 7:53 PM Kees Cook <keescook@chromium.org> wrote:
> > > >
> > > > Hi Ingo,
> > > >
> > > > The ever-shortening series. ;) Here is "v7", which is just the remaining
> > > > Makefile changes to enable orphan section warnings, now updated to
> > > > include ld-option calls.
> > > >
> > > > Thanks for getting this all into -tip!
> > > 
> > > For the series,
> > > Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
> > > 
> > > As the recent ppc vdso boogaloo exposed, what about the vdsos?
> > > * arch/x86/entry/vdso/Makefile
> > > * arch/arm/vdso/Makefile
> > > * arch/arm64/kernel/vdso/Makefile
> > > * arch/arm64/kernel/vdso32/Makefile
> > 
> > Kees, will these patches DTRT for the vDSO builds? I will be unable to test 
> > these patches on that old system until tomorrow the earliest.
> 
> I would like to see VDSO done next, but it's entirely separate from
> this series. This series only touches the core kernel build (i.e. via the
> interactions with scripts/link-vmlinux.sh) or the boot stubs. So there
> is no impact on VDSO linking.

Great!

I also double checked that things still build fine with ancient LD.

> > I'm keeping these latest changes in WIP.core/build for now.
> 
> They should be safe to land in -next, which is important so we can shake
> out any other sneaky sections that all our existing testing hasn't
> found. :)

OK, cool - I've graduated them over into tip:core/build. :-)

Thanks,

	Ingo