[tip:,x86/urgent] x86: Fix early boot crash on gcc-10, third try

 

https://lore.kernel.org/patchwork/patch/1242401/

Message ID 158954160454.17951.15828011095215471629.tip-bot2@tip-bot2
State Accepted
Commit a9a3ed1eff3601b63aea4fb462d8b3b92c7c1e7e
Headers show
Series
  • [tip:,x86/urgent] x86: Fix early boot crash on gcc-10, third try
Related show
 

Commit Message

tip-bot2 for Dan Williams May 15, 2020, 11:20 a.m. UTC
The following commit has been merged into the x86/urgent branch of tip:

Commit-ID:     a9a3ed1eff3601b63aea4fb462d8b3b92c7c1e7e
Gitweb: https://git.kernel.org/tip/a9a3ed1eff3601b63aea4fb462d8b3b92c7c1e7e
Author: Borislav Petkov <bp@suse.de>
AuthorDate: Wed, 22 Apr 2020 18:11:30 +02:00
Committer: Borislav Petkov <bp@suse.de>
CommitterDate: Fri, 15 May 2020 11:48:01 +02:00 x86: Fix early boot crash on gcc-10, third try ... or the odyssey of trying to disable the stack protector for the
function which generates the stack canary value. The whole story started with Sergei reporting a boot crash with a kernel
built with gcc-10: Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139
Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013
Call Trace:
dump_stack
panic
? start_secondary
__stack_chk_fail
start_secondary
secondary_startup_64
-—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary This happens because gcc-10 tail-call optimizes the last function call
in start_secondary() - cpu_startup_entry() - and thus emits a stack
canary check which fails because the canary value changes after the
boot_init_stack_canary() call. To fix that, the initial attempt was to mark the one function which
generates the stack canary with: __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused) however, using the optimize attribute doesn't work cumulatively
as the attribute does not add to but rather replaces previously
supplied optimization options - roughly all -fxxx options. The key one among them being -fno-omit-frame-pointer and thus leading to
not present frame pointer - frame pointer which the kernel needs. The next attempt to prevent compilers from tail-call optimizing
the last function call cpu_startup_entry(), shy of carving out
start_secondary() into a separate compilation unit and building it with
-fno-stack-protector, was to add an empty asm(""). This current solution was short and sweet, and reportedly, is supported
by both compilers but we didn't get very far this time: future (LTO?)
optimization passes could potentially eliminate this, which leads us
to the third attempt: having an actual memory barrier there which the
compiler cannot ignore or move around etc. That should hold for a long time, but hey we said that about the other
two solutions too so... Reported-by: Sergei Trofimovich <slyfox@gentoo.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Tested-by: Kalle Valo <kvalo@codeaurora.org>
Cc: <stable@vger.kernel.org>
Link: https://lkml.kernel.org/r/20200314164451.346497-1-slyfox@gentoo.org
---
arch/x86/include/asm/stackprotector.h | 7 ++++++-
arch/x86/kernel/smpboot.c | 8 ++++++++
arch/x86/xen/smp_pv.c | 1 +
include/linux/compiler.h | 6 ++++++
init/main.c | 2 ++
5 files changed, 23 insertions(+), 1 deletion(-)

Patch

 
diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
index 91e29b6..9804a79 100644
--- a/arch/x86/include/asm/stackprotector.h
+++ b/arch/x86/include/asm/stackprotector.h
@@ -55,8 +55,13 @@
/*
* Initialize the stackprotector canary value.
*
- * NOTE: this must only be called from functions that never return,
+ * NOTE: this must only be called from functions that never return
* and it must always be inlined.
+ *
+ * In addition, it should be called from a compilation unit for which
+ * stack protector is disabled. Alternatively, the caller should not end
+ * with a function call which gets tail-call optimized as that would
+ * lead to checking a modified canary value.
*/
static __always_inline void boot_init_stack_canary(void)
{
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 8c89e4d..2f24c33 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -266,6 +266,14 @@ static void notrace start_secondary(void *unused) wmb();
cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
+
+ /*
+ * Prevent tail call to cpu_startup_entry() because the stack protector
+ * guard has been changed a couple of function calls up, in
+ * boot_init_stack_canary() and must not be checked before tail calling
+ * another function.
+ */
+ prevent_tail_call_optimization();
} /**
diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c
index 8fb8a50..f2adb63 100644
--- a/arch/x86/xen/smp_pv.c
+++ b/arch/x86/xen/smp_pv.c
@@ -93,6 +93,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void)
cpu_bringup();
boot_init_stack_canary();
cpu_startup_entry(CPUHP_AP_ONLINE_IDLE);
+ prevent_tail_call_optimization();
} void xen_smp_intr_free_pv(unsigned int cpu)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 034b0a6..448c91b 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off)
/* &a[0] degrades to a pointer: a different type from an array */
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) +/*
+ * This is needed in functions which generate the stack canary, see
+ * arch/x86/kernel/smpboot.c::start_secondary() for an example.
+ */
+#define prevent_tail_call_optimization() mb()
+
#endif /* __LINUX_COMPILER_H */
diff --git a/init/main.c b/init/main.c
index 1a5da2c..ad3812b 100644
--- a/init/main.c
+++ b/init/main.c
@@ -1036,6 +1036,8 @@ asmlinkage __visible void __init start_kernel(void) /* Do the rest non-__init'ed, we're now alive */
arch_call_rest_init();
+
+ prevent_tail_call_optimization();
} /* Call all constructor functions linked into the kernel. */

[tip:,x86/urgent] x86: Fix early boot crash on gcc-10, third try的更多相关文章

  1. 【X86】---X86处理器大小端的数据存储验证

    之前也关注过大小端的存储,可能时间久了,加之又之前的电脑抽象换成了当前的处理器寄存器的值判断,导致自己总是有点蒙圈.看Spec手册的时候,有时会无法与手册中某个Bit的值与RU/RW工具读出来的对应上 ...

  2. Fix Elementary Boot Screen (plymouth) After Installing Nvidia Drivers

    Q:I just installed propietary nvidia drivers, after that the glowing “e” plymouth theme was gone, on ...

  3. MIT JOS学习笔记01:环境配置、Boot Loader(2016.10.22)

    未经许可谢绝以任何形式对本文内容进行转载! 一.环境配置 关于MIT课程中使用的JOS的配置教程网上已经有很多了,在这里就不做介绍,个人使用的是Ubuntu 16.04 + qemu.另注,本文章中贴 ...

  4. Spring Boot 学习系列(10)—SpringBoot+JSP的使

    此文已由作者易国强授权网易云社区发布. 欢迎访问网易云社区,了解更多网易技术产品运营经验. 解决问题 随着spring boot 框架的逐步使用,我们期望对于一些已有的系统进行改造,做成通用的脚手架, ...

  5. # 曹工说Spring Boot源码(10)-- Spring解析xml文件,到底从中得到了什么(context:annotation-config 解析)

    写在前面的话 相关背景及资源: 曹工说Spring Boot源码(1)-- Bean Definition到底是什么,附spring思维导图分享 曹工说Spring Boot源码(2)-- Bean ...

  6. System Address Map Initialization in x86/x64 Architecture Part 2: PCI Express-Based Systems

      原文  http://resources.infosecinstitute.com/system-address-map-initialization-x86x64-architecture-pa ...

  7. 用Qemu搭建x86学习环境

    作者信息 作者:彭东林 邮箱:pengdonglin137@163.com QQ:405728433 软件平台 主机: Ubuntu14.04 64位版本 模拟器:Qemu-2.8.0 Linux内核 ...

  8. linux上配置bochs,搭建基于X86架构操作系统的开发环境

    学习操作系统最好的方法就是自己编写新的操作系统,或者修改已有的操作系统.但是如果在真机上完成这个过程,调试会成为一个很大的问题.利用虚拟机来完成,可以使调试过程变得简单,而且能节约很多开关机的时间. ...

  9. linux内核移植X86平台的例子

    bootloader支持启动多个Linux 内核安装(X86平台) 1. cparch/x86/boot/bzImage /boot/vmlinuz-$version 2. cp $initrd /b ...

随机推荐

  1. P2414 [NOI2011]阿狸的打字机 AC自动机

    题意 给定n个模式串,有m个询问,每次询问第X个模式串在第Y个模中出现了多少次 解题思路 以fail树相反的方向建一棵树T,问题转化为X的子树中有多少个y的终止节点.跑出T的dfs序,X的子树就可以表 ...

  2. Agumaster漂亮起来了

  3. Ubuntu18.04

    起因 晚上过来加班···· 问题 物理机安装ubuntu时候遇到报错信息 boot failed: please change disks and press a key to continue ht ...

  4. leetcode刷题-86分隔链表

    题目 给定一个链表和一个特定值 x,对链表进行分隔,使得所有小于 x 的节点都在大于或等于 x 的节点之前. 你应当保留两个分区中每个节点的初始相对位置. 示例: 输入: head = 1->4 ...

  5. [计算机网络]TCP/IP协议-运输层

    TCP/IP体系结构 TCP/IP四层协议 五层协议 协议 作用 应用层 应用层 HTTP超文本传输协议.FTP文件传输协议 - 运输层 运输层 TCP(面向连接的,可靠的).UDP(无连接的,不保证 ...

  6. [剑指Offer]61-扑克牌中的顺子

    题目 "红心A,黑桃3,小王,大王,方片5",大\小 王可以看成任何数字,并且A看作1,J为11,Q为12,K为13.上面的5张牌就可以变成"1,2,3,4,5" ...

  7. C# 中 Struct 和 Class 的区别总结

    翻译自 Manju lata Yadav 2019年6月2日 的博文 <Difference Between Struct And Class In C#>,补充了一些内容和示例. 结构体 ...

  8. JVM垃圾回收器前瞻

    垃圾回收器的新发展   GC仍然处于飞速发展之中,目前的默认选项G1 GC在不断的进行改进,很多我们原来认为的缺点,例如串行的Full GC.Card Table扫描的低效等,都已经被大幅改进,例如, ...

  9. 2.1 Spring5源码编译

    一. 准备工作 1. . 编译环境 maven jdk8 idea 2. 编译版本: SpringV5.2.7RELEASE+GradleWapper+jdk1.8.0_131编译 二. 源码下载 g ...

  10. maven打包(jar)类型错误

    maven项目打包测试环境时部署发现是开发环境.确认打包命令无误, 此情况下将target内容全部删除,重新打包即可.是全部删除.