From patchwork Mon Jun 29 06:18:39 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 206279 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH, MAILING_LIST_MULTI, SIGNED_OFF_BY, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 73F43C433DF for ; Mon, 29 Jun 2020 20:56:48 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 53DB4206F1 for ; Mon, 29 Jun 2020 20:56:48 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=chromium.org header.i=@chromium.org header.b="jRyLPLKJ" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731491AbgF2U4r (ORCPT ); Mon, 29 Jun 2020 16:56:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43392 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731280AbgF2TNJ (ORCPT ); Mon, 29 Jun 2020 15:13:09 -0400 Received: from mail-pg1-x542.google.com (mail-pg1-x542.google.com [IPv6:2607:f8b0:4864:20::542]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06820C08EB1E for ; Sun, 28 Jun 2020 23:27:30 -0700 (PDT) Received: by mail-pg1-x542.google.com with SMTP id e18so7832795pgn.7 for ; Sun, 28 Jun 2020 23:27:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=OcuGTfSUXtPYMFfpENNYu5S2NR6isuQ9uC03+go4k80=; b=jRyLPLKJ/wflGnWNIhsw1/xtdO++qU/4G4jZjo+lnOqYVWgtIzMYOnTwQtGOp4VTv+ b8zRHjoyL25oKD4tWfpH43lrpeGB8egY2xI+HOcY319Hsy/yzaeePZ8YwW/uqTnkDoS9 fbCN5nnFFpuj2qqzr47ls2rlOBAuxjOrocN5I= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=OcuGTfSUXtPYMFfpENNYu5S2NR6isuQ9uC03+go4k80=; b=uKF2Jed/dVZQjvlA5v4F/FDimdqSHNgyFZfDuGnhI7TrgWtxaadT4oo2aDOMutnOhx ru6EZjHohOC3jTnhTyqfwa410Vg9AOsmlHkTBV4+1cNdf9LdvvPY0HtPAS0HPphDT8J7 LwzFUlVQlwWRjCBN0f4lhDzw74ukYAeLoP4+Z1/Qs6sa9tjw51wuwtYWMhJq7+vm1UxI mv0WUGZhwMDVd3G/ZG5BJj15wLOPgD5HvVf5cE1W174oc68eGU1r26DqeVtKUfNHrabt o2R5nYLOpHj0U+Jb3lk9iJo1Ce7MtuzkPzbr1WBeIrjnBUKV+aHDGZAT4CNvXGe9+Z7S Tjyw== X-Gm-Message-State: AOAM532m1nRy5d79Hzafwp4bStK/r2Y3BT14J391gDG8d7Q+LLM2+RZi yZdl/lr/zKQ+oHQq9r2640Kwrg== X-Google-Smtp-Source: ABdhPJyp58Bg9f7GuaQUlT4KpenbA1Jul+PfAUND8VkiaE+umM/0tCY0B+FCqda7VoHqscVan5uu+w== X-Received: by 2002:a62:1646:: with SMTP id 67mr13176339pfw.281.1593412049613; Sun, 28 Jun 2020 23:27:29 -0700 (PDT) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id 27sm18066808pjg.19.2020.06.28.23.27.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 28 Jun 2020 23:27:28 -0700 (PDT) From: Kees Cook To: Will Deacon Cc: Kees Cook , Catalin Marinas , Mark Rutland , Ard Biesheuvel , Peter Collingbourne , James Morse , Borislav Petkov , Thomas Gleixner , Ingo Molnar , Russell King , Masahiro Yamada , Arvind Sankar , Nick Desaulniers , Nathan Chancellor , Arnd Bergmann , x86@kernel.org, clang-built-linux@googlegroups.com, linux-arch@vger.kernel.org, linux-efi@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH v4 16/17] x86/build: Warn on orphan section placement Date: Sun, 28 Jun 2020 23:18:39 -0700 Message-Id: <20200629061840.4065483-17-keescook@chromium.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200629061840.4065483-1-keescook@chromium.org> References: <20200629061840.4065483-1-keescook@chromium.org> MIME-Version: 1.0 Sender: linux-efi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-efi@vger.kernel.org We don't want to depend on the linker's orphan section placement heuristics as these can vary between linkers, and may change between versions. All sections need to be explicitly named in the linker script. Discards the unused rela, plt, and got sections that are not needed in the final vmlinux, stop emitting kprobe sections without kprobes, and enable orphan section warnings. Signed-off-by: Kees Cook --- arch/x86/Makefile | 4 ++++ arch/x86/include/asm/asm.h | 6 +++++- arch/x86/kernel/vmlinux.lds.S | 6 ++++++ 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 00e378de8bc0..f8a5b2333729 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -51,6 +51,10 @@ ifdef CONFIG_X86_NEED_RELOCS LDFLAGS_vmlinux := --emit-relocs --discard-none endif +# We never want expected sections to be placed heuristically by the +# linker. All sections should be explicitly named in the linker script. +LDFLAGS_vmlinux += --orphan-handling=warn + # # Prevent GCC from generating any FP code by mistake. # diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h index 0f63585edf5f..92feec0f0a12 100644 --- a/arch/x86/include/asm/asm.h +++ b/arch/x86/include/asm/asm.h @@ -138,11 +138,15 @@ # define _ASM_EXTABLE_FAULT(from, to) \ _ASM_EXTABLE_HANDLE(from, to, ex_handler_fault) -# define _ASM_NOKPROBE(entry) \ +# ifdef CONFIG_KPROBES +# define _ASM_NOKPROBE(entry) \ .pushsection "_kprobe_blacklist","aw" ; \ _ASM_ALIGN ; \ _ASM_PTR (entry); \ .popsection +# else +# define _ASM_NOKPROBE(entry) +# endif #else # define _EXPAND_EXTABLE_HANDLE(x) #x diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S index 504d16968ed8..52e2b4952a0b 100644 --- a/arch/x86/kernel/vmlinux.lds.S +++ b/arch/x86/kernel/vmlinux.lds.S @@ -413,6 +413,12 @@ SECTIONS ELF_DETAILS DISCARDS + /DISCARD/ : { + *(.rela.*) *(.rela_*) + *(.rel.*) *(.rel_*) + *(.got) *(.got.*) + *(.igot.*) *(.iplt) + } }