From patchwork Fri Feb 28 00:22:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 11411193 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 6E6D414BC for ; Fri, 28 Feb 2020 00:22:53 +0000 (UTC) Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 4AC3C2469F for ; Fri, 28 Feb 2020 00:22:53 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="Krxs5whQ"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="nHZ4Y7Yb" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 4AC3C2469F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=chromium.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20170209; h=Sender: Content-Transfer-Encoding:Content-Type:Cc:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To: Message-Id:Date:Subject:To:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=VFCjU7xZ7/k2JJ+ojaxAHUWcpqTleEiX/z0ERqYv7x8=; b=Krxs5whQRRttG3 3jxAHxHPKcEoowwAEdhiMYH3IZhoXSsE5KwMWY0gj7YBIR3uvvlTjqwIEPTU84RrHDDAELAbAeyoF Vsgz003JzhtfigVOzrYvhKIqaoG+pr62oAGMdtLojlsXzPvcrZRhIuKL0PMAMg330df6P5oONEChB hk8emol47JCI3mLbeLxLH3aBOPtefEKiY9MKm+fP9ApXdcji3vHgAtopLWYt6K3kEHVL930dankML d1iwZcoKCMkdE3yYyphnHLKmjLSo64pGqE4sBhfvqfbkXz0HW5uslDDkADioVZtFz+mCt7v64pqgD KQR9YG70kVBO2LtsGM8g==; Received: from localhost ([127.0.0.1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1j7TQb-000119-0H; Fri, 28 Feb 2020 00:22:53 +0000 Received: from mail-pf1-x442.google.com ([2607:f8b0:4864:20::442]) by bombadil.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1j7TQY-0000zf-GV for linux-arm-kernel@lists.infradead.org; Fri, 28 Feb 2020 00:22:51 +0000 Received: by mail-pf1-x442.google.com with SMTP id i19so737113pfa.2 for ; Thu, 27 Feb 2020 16:22:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=oFQSSd8joQB26Yle3LRphyYOwCqM8lXqrwgR7KUB2ZM=; b=nHZ4Y7YbhF6uEk5/uFndEuekX2vKGSTC1OQpgCF1rYdVz1hL9KwhWsI6HLQwltLv2c olhA+OX8/TcWhf7cu831s2b1jUqHSYSvZqA7RHqWjI7TZURQ1M6+nuep8zkL0yqIzO/G rYLC+NOCo0eRuvYBoJQwHOB1tY/rFRwdZY/+s= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=oFQSSd8joQB26Yle3LRphyYOwCqM8lXqrwgR7KUB2ZM=; b=EVBzvvtPeJMqKH0LxgXVqnr8BiGqxweND0r+MVIUrM1vLpBLgFzrNLV7SB25IiMB6p NOB8SFMsgZonfwE1EFBPwP+loJK/zk3H4oXws6+3ucXbYLLYK7y9Dgx1xv9qNHqQAHJr t21uHt7k80v0fV17ZguezyGcYxp1osOA1c1X1eAESR6yrkxvzSW30Ns5jHKpPhw6dNrp UJpAMIsOlGHw/VOJmxIZQGKZyG28ypYWnsMcraFWqct6lwG/QGGGmRRfSnbeSTpf/YJn rE6rQf6u5FwBCZGERTQ9R6tFtLsA6FLmc6fe2TjIPGoBYywE4mnGQOC0/7HL8SfyId2p aoIg== X-Gm-Message-State: APjAAAWP275BI8/MeBxMvjPU0HU1jX5F/DgkWBf1ovytgwb7PCZ/Mydu 8sNYibl5Q03QXqN8qnMmmlZbMw== X-Google-Smtp-Source: APXvYqw6fCWM2xfT4DJ+VFMmyrDy6sPXs7ZYweUNi5l07x3V/XFaixY8I4K8wHA9HcWwEBIBYQBH6A== X-Received: by 2002:a63:5713:: with SMTP id l19mr1913060pgb.216.1582849369348; Thu, 27 Feb 2020 16:22:49 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id h5sm7577879pgi.28.2020.02.27.16.22.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 27 Feb 2020 16:22:48 -0800 (PST) From: Kees Cook To: Borislav Petkov Subject: [PATCH 4/9] x86/boot: Warn on orphan section placement Date: Thu, 27 Feb 2020 16:22:39 -0800 Message-Id: <20200228002244.15240-5-keescook@chromium.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20200228002244.15240-1-keescook@chromium.org> References: <20200228002244.15240-1-keescook@chromium.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200227_162250_571699_418E822D X-CRM114-Status: GOOD ( 13.04 ) X-Spam-Score: -0.2 (/) X-Spam-Report: SpamAssassin version 3.4.3 on bombadil.infradead.org summary: Content analysis details: (-0.2 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no trust [2607:f8b0:4864:20:0:0:0:442 listed in] [list.dnswl.org] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record -0.1 DKIM_VALID_EF Message has a valid DKIM or DK signature from envelope-from domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.0 DKIMWL_WL_HIGH DKIMwl.org - Whitelisted High sender X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Mark Rutland , "H.J. Lu" , Kees Cook , Arnd Bergmann , linux-kbuild@vger.kernel.org, Peter Collingbourne , Catalin Marinas , Masahiro Yamada , x86@kernel.org, Russell King , linux-kernel@vger.kernel.org, clang-built-linux@googlegroups.com, James Morse , linux-arch@vger.kernel.org, Will Deacon , linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org We don't want to depend on the linker's orphan section placement heuristics as these can vary between linkers, and may change between versions. All sections need to be explicitly named in the linker script. Add the common debugging sections. Discard the unused note, rel, plt, dyn, and hash sections that are not needed in the compressed vmlinux. Disable .eh_frame generation in the linker and enable orphan section warnings. Signed-off-by: Kees Cook --- arch/x86/boot/compressed/Makefile | 3 ++- arch/x86/boot/compressed/vmlinux.lds.S | 13 +++++++++++++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile index c33111341325..e0ea6b0924e8 100644 --- a/arch/x86/boot/compressed/Makefile +++ b/arch/x86/boot/compressed/Makefile @@ -46,6 +46,7 @@ GCOV_PROFILE := n UBSAN_SANITIZE :=n KBUILD_LDFLAGS := -m elf_$(UTS_MACHINE) +KBUILD_LDFLAGS += --no-ld-generated-unwind-info # Compressed kernel should be built as PIE since it may be loaded at any # address by the bootloader. ifeq ($(CONFIG_X86_32),y) @@ -57,7 +58,7 @@ else KBUILD_LDFLAGS += $(shell $(LD) --help 2>&1 | grep -q "\-z noreloc-overflow" \ && echo "-z noreloc-overflow -pie --no-dynamic-linker") endif -LDFLAGS_vmlinux := -T +LDFLAGS_vmlinux := --orphan-handling=warn -T hostprogs := mkpiggy HOST_EXTRACFLAGS += -I$(srctree)/tools/include diff --git a/arch/x86/boot/compressed/vmlinux.lds.S b/arch/x86/boot/compressed/vmlinux.lds.S index 508cfa6828c5..b5406a8cebe0 100644 --- a/arch/x86/boot/compressed/vmlinux.lds.S +++ b/arch/x86/boot/compressed/vmlinux.lds.S @@ -73,4 +73,17 @@ SECTIONS #endif . = ALIGN(PAGE_SIZE); /* keep ZO size page aligned */ _end = .; + + STABS_DEBUG + DWARF_DEBUG + + DISCARDS + /DISCARD/ : { + *(.note.*) + *(.rela.*) *(.rela_*) + *(.rel.*) *(.rel_*) + *(.plt) *(.plt.*) + *(.dyn*) + *(.hash) *(.gnu.hash) + } }