From: Nick Desaulniers <ndesaulniers@google.com> To: Nathan Chancellor <natechancellor@gmail.com>, Masahiro Yamada <masahiroy@kernel.org> Cc: Michal Marek <michal.lkml@markovi.net>, Catalin Marinas <catalin.marinas@arm.com>, Will Deacon <will@kernel.org>, Russell King <linux@armlinux.org.uk>, Florian Fainelli <f.fainelli@gmail.com>, Arnd Bergmann <arnd@arndb.de>, Abbott Liu <liuwenliang@huawei.com>, Linus Walleij <linus.walleij@linaro.org>, Jian Cai <jiancai@google.com>, Andrey Ryabinin <aryabinin@virtuozzo.com>, Mike Rapoport <rppt@linux.ibm.com>, Ard Biesheuvel <ardb@kernel.org>, Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>, Linux ARM <linux-arm-kernel@lists.infradead.org> Subject: Re: [PATCH] kbuild: Always link with '-z norelro' Date: Thu, 12 Nov 2020 16:44:46 -0800 [thread overview] Message-ID: <CAKwvOdkShrqgNDWO0bsPcPZLx-+u79mfmPrGy7CnSKZVdcYzSA@mail.gmail.com> (raw) In-Reply-To: <20201112183839.1009297-1-natechancellor@gmail.com> On Thu, Nov 12, 2020 at 10:41 AM Nathan Chancellor <natechancellor@gmail.com> wrote: > > Commit 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker > script and options") added '-z norelro' to the arm64 Makefile when > CONFIG_RELOCATABLE was set to help support ld.lld because ld.lld > defaults to '-z relro' but the kernel does not use program headers or > adhere to the section layout that is required for RELRO to work. > > Commit 3b92fa7485eb ("arm64: link with -z norelro regardless of > CONFIG_RELOCATABLE") unconditionally added it to LDFLAGS_vmlinux because > an error occurs with CONFIG_KASAN set even when CONFIG_RELOCATABLE is > unset. > > As it turns out, ARM experiences the same error after CONFIG_KASAN was > implemented, meaning that '-z norelro' needs to be added to that > Makefile as well (multi_v7_defconfig + CONFIG_KASAN=y + LD=ld.lld): > > $ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- LLVM=1 zImage > ld.lld: error: section: .exit.data is not contiguous with other relro sections > > To avoid playing whack-a-mole with different architectures over time, > hoist '-z norelro' into the main Makefile. This does not affect ld.bfd > because '-z norelro' is the default for it. > > Link: https://github.com/ClangBuiltLinux/linux/issues/1189 > Suggested-by: Nick Desaulniers <ndesaulniers@google.com> > Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Why not add it additionally to KBUILD_LDFLAGS_MODULE a la `--build-id=sha1` a few lines above? (or `LDFLAGS_MODULE`, but that looks unused?) We probably don't want this for modules either. In that case, you could add -z norelo to the two existing lines with `--build-id=sha1` above? > --- > > Hi all, > > This should probably go into Russell's tree with acks from the arm64 and > kbuild maintainers. > > Cheers, > Nathan > > Makefile | 2 ++ > arch/arm64/Makefile | 2 +- > 2 files changed, 3 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 008aba5f1a20..648bfb486244 100644 > --- a/Makefile > +++ b/Makefile > @@ -984,6 +984,8 @@ ifeq ($(CONFIG_RELR),y) > LDFLAGS_vmlinux += --pack-dyn-relocs=relr > endif > > +LDFLAGS_vmlinux += -z norelro > + > # Align the bit size of userspace programs with the kernel > KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) > KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) > diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile > index 5789c2d18d43..85495ff8f0fd 100644 > --- a/arch/arm64/Makefile > +++ b/arch/arm64/Makefile > @@ -10,7 +10,7 @@ > # > # Copyright (C) 1995-2001 by Russell King > > -LDFLAGS_vmlinux :=--no-undefined -X -z norelro > +LDFLAGS_vmlinux :=--no-undefined -X > > ifeq ($(CONFIG_RELOCATABLE), y) > # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour > > base-commit: f8394f232b1eab649ce2df5c5f15b0e528c92091 > -- > 2.29.2 > -- Thanks, ~Nick Desaulniers
WARNING: multiple messages have this Message-ID (diff)
From: Nick Desaulniers <ndesaulniers@google.com> To: Nathan Chancellor <natechancellor@gmail.com>, Masahiro Yamada <masahiroy@kernel.org> Cc: Florian Fainelli <f.fainelli@gmail.com>, Arnd Bergmann <arnd@arndb.de>, Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>, Catalin Marinas <catalin.marinas@arm.com>, Linus Walleij <linus.walleij@linaro.org>, Russell King <linux@armlinux.org.uk>, Jian Cai <jiancai@google.com>, Michal Marek <michal.lkml@markovi.net>, Linux ARM <linux-arm-kernel@lists.infradead.org>, Abbott Liu <liuwenliang@huawei.com>, Andrey Ryabinin <aryabinin@virtuozzo.com>, Mike Rapoport <rppt@linux.ibm.com>, Will Deacon <will@kernel.org>, Ard Biesheuvel <ardb@kernel.org>, LKML <linux-kernel@vger.kernel.org> Subject: Re: [PATCH] kbuild: Always link with '-z norelro' Date: Thu, 12 Nov 2020 16:44:46 -0800 [thread overview] Message-ID: <CAKwvOdkShrqgNDWO0bsPcPZLx-+u79mfmPrGy7CnSKZVdcYzSA@mail.gmail.com> (raw) In-Reply-To: <20201112183839.1009297-1-natechancellor@gmail.com> On Thu, Nov 12, 2020 at 10:41 AM Nathan Chancellor <natechancellor@gmail.com> wrote: > > Commit 3bbd3db86470 ("arm64: relocatable: fix inconsistencies in linker > script and options") added '-z norelro' to the arm64 Makefile when > CONFIG_RELOCATABLE was set to help support ld.lld because ld.lld > defaults to '-z relro' but the kernel does not use program headers or > adhere to the section layout that is required for RELRO to work. > > Commit 3b92fa7485eb ("arm64: link with -z norelro regardless of > CONFIG_RELOCATABLE") unconditionally added it to LDFLAGS_vmlinux because > an error occurs with CONFIG_KASAN set even when CONFIG_RELOCATABLE is > unset. > > As it turns out, ARM experiences the same error after CONFIG_KASAN was > implemented, meaning that '-z norelro' needs to be added to that > Makefile as well (multi_v7_defconfig + CONFIG_KASAN=y + LD=ld.lld): > > $ make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- LLVM=1 zImage > ld.lld: error: section: .exit.data is not contiguous with other relro sections > > To avoid playing whack-a-mole with different architectures over time, > hoist '-z norelro' into the main Makefile. This does not affect ld.bfd > because '-z norelro' is the default for it. > > Link: https://github.com/ClangBuiltLinux/linux/issues/1189 > Suggested-by: Nick Desaulniers <ndesaulniers@google.com> > Signed-off-by: Nathan Chancellor <natechancellor@gmail.com> Why not add it additionally to KBUILD_LDFLAGS_MODULE a la `--build-id=sha1` a few lines above? (or `LDFLAGS_MODULE`, but that looks unused?) We probably don't want this for modules either. In that case, you could add -z norelo to the two existing lines with `--build-id=sha1` above? > --- > > Hi all, > > This should probably go into Russell's tree with acks from the arm64 and > kbuild maintainers. > > Cheers, > Nathan > > Makefile | 2 ++ > arch/arm64/Makefile | 2 +- > 2 files changed, 3 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 008aba5f1a20..648bfb486244 100644 > --- a/Makefile > +++ b/Makefile > @@ -984,6 +984,8 @@ ifeq ($(CONFIG_RELR),y) > LDFLAGS_vmlinux += --pack-dyn-relocs=relr > endif > > +LDFLAGS_vmlinux += -z norelro > + > # Align the bit size of userspace programs with the kernel > KBUILD_USERCFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) > KBUILD_USERLDFLAGS += $(filter -m32 -m64 --target=%, $(KBUILD_CFLAGS)) > diff --git a/arch/arm64/Makefile b/arch/arm64/Makefile > index 5789c2d18d43..85495ff8f0fd 100644 > --- a/arch/arm64/Makefile > +++ b/arch/arm64/Makefile > @@ -10,7 +10,7 @@ > # > # Copyright (C) 1995-2001 by Russell King > > -LDFLAGS_vmlinux :=--no-undefined -X -z norelro > +LDFLAGS_vmlinux :=--no-undefined -X > > ifeq ($(CONFIG_RELOCATABLE), y) > # Pass --no-apply-dynamic-relocs to restore pre-binutils-2.27 behaviour > > base-commit: f8394f232b1eab649ce2df5c5f15b0e528c92091 > -- > 2.29.2 > -- Thanks, ~Nick Desaulniers _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2020-11-13 0:45 UTC|newest] Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-11-12 18:38 [PATCH] kbuild: Always link with '-z norelro' Nathan Chancellor 2020-11-12 18:38 ` Nathan Chancellor 2020-11-13 0:44 ` Nick Desaulniers [this message] 2020-11-13 0:44 ` Nick Desaulniers 2020-11-13 0:53 ` Nathan Chancellor 2020-11-13 0:53 ` Nathan Chancellor 2020-11-13 6:06 ` Ard Biesheuvel 2020-11-13 6:06 ` Ard Biesheuvel 2020-11-13 19:34 ` Nick Desaulniers 2020-11-13 19:34 ` Nick Desaulniers 2020-11-18 23:05 ` Nick Desaulniers 2020-11-18 23:05 ` Nick Desaulniers 2020-11-18 23:06 ` Ard Biesheuvel 2020-11-18 23:06 ` Ard Biesheuvel 2020-11-18 23:24 ` Nick Desaulniers 2020-11-18 23:24 ` Nick Desaulniers 2020-11-19 19:33 ` Nathan Chancellor 2020-11-19 19:33 ` Nathan Chancellor 2020-11-16 12:31 ` Catalin Marinas 2020-11-16 12:31 ` Catalin Marinas 2020-11-17 21:17 ` Linus Walleij 2020-11-17 21:17 ` Linus Walleij
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=CAKwvOdkShrqgNDWO0bsPcPZLx-+u79mfmPrGy7CnSKZVdcYzSA@mail.gmail.com \ --to=ndesaulniers@google.com \ --cc=ardb@kernel.org \ --cc=arnd@arndb.de \ --cc=aryabinin@virtuozzo.com \ --cc=catalin.marinas@arm.com \ --cc=f.fainelli@gmail.com \ --cc=jiancai@google.com \ --cc=linus.walleij@linaro.org \ --cc=linux-arm-kernel@lists.infradead.org \ --cc=linux-kbuild@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux@armlinux.org.uk \ --cc=liuwenliang@huawei.com \ --cc=masahiroy@kernel.org \ --cc=michal.lkml@markovi.net \ --cc=natechancellor@gmail.com \ --cc=rppt@linux.ibm.com \ --cc=will@kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.