* [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code
@ 2025-03-12 10:27 Ard Biesheuvel
2025-03-12 11:09 ` Brian Gerst
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Ard Biesheuvel @ 2025-03-12 10:27 UTC (permalink / raw)
To: linux-kernel; +Cc: llvm, x86, Ard Biesheuvel, Borislav Petkov, Brian Gerst
From: Ard Biesheuvel <ardb@kernel.org>
Clang versions before 17 will not honour -fdirect-access-external-data
for the load of the stack cookie emitted into each function's prologue
and epilogue, and will emit a GOT based reference instead, e.g.,
4c 8b 2d 00 00 00 00 mov 0x0(%rip),%r13
18a: R_X86_64_REX_GOTPCRELX __ref_stack_chk_guard-0x4
65 49 8b 45 00 mov %gs:0x0(%r13),%rax
This is inefficient, but at least, the linker will usually follow the
rules of the x86 psABI, and relax the GOT load into a RIP-relative LEA
instruction. This is still suboptimal, as the per-CPU load could use a
RIP-relative reference directly, but at least it gets rid of the first
load from memory.
However, Boris reports that in some cases, when using distro builds of
Clang/LLD 15, the first load gets relaxed into
49 c7 c6 20 c0 55 86 mov $0xffffffff8655c020,%r14
ffffffff8373bf0f: R_X86_64_32S __ref_stack_chk_guard
65 49 8b 06 mov %gs:(%r14),%rax
instead, which is fine in principle, as MOV may be cheaper than LEA on
some micro-architectures. However, such absolute references assume that
the variable in question can be accessed via the kernel virtual mapping,
and this is not guaranteed for the startup code residing in .head.text.
This is therefore a true positive, that was caught using the recently
introduced relocs check for absolute references in the startup code:
Absolute reference to symbol '__ref_stack_chk_guard' not permitted in .head.text
Work around the issue by disabling the stack protector in the startup
code for Clang versions older than 17.
Fixes: 80d47defddc0 ("x86/stackprotector/64: Convert to normal per-CPU variable")
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/x86/include/asm/init.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 0e82ebc5d1e1..8b1b1abcef15 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -2,7 +2,11 @@
#ifndef _ASM_X86_INIT_H
#define _ASM_X86_INIT_H
+#if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
+#define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector
+#else
#define __head __section(".head.text") __no_sanitize_undefined
+#endif
struct x86_mapping_info {
void *(*alloc_pgt_page)(void *); /* allocate buf for page table */
--
2.49.0.rc0.332.g42c0ae87b1-goog
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code
2025-03-12 10:27 [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code Ard Biesheuvel
@ 2025-03-12 11:09 ` Brian Gerst
2025-03-12 11:17 ` Ard Biesheuvel
2025-03-12 11:20 ` [tip: x86/asm] " tip-bot2 for Ard Biesheuvel
2025-03-19 11:03 ` [tip: x86/core] " tip-bot2 for Ard Biesheuvel
2 siblings, 1 reply; 5+ messages in thread
From: Brian Gerst @ 2025-03-12 11:09 UTC (permalink / raw)
To: Ard Biesheuvel; +Cc: linux-kernel, llvm, x86, Ard Biesheuvel, Borislav Petkov
On Wed, Mar 12, 2025 at 6:27 AM Ard Biesheuvel <ardb+git@google.com> wrote:
>
> From: Ard Biesheuvel <ardb@kernel.org>
>
> Clang versions before 17 will not honour -fdirect-access-external-data
> for the load of the stack cookie emitted into each function's prologue
> and epilogue, and will emit a GOT based reference instead, e.g.,
>
> 4c 8b 2d 00 00 00 00 mov 0x0(%rip),%r13
> 18a: R_X86_64_REX_GOTPCRELX __ref_stack_chk_guard-0x4
> 65 49 8b 45 00 mov %gs:0x0(%r13),%rax
>
> This is inefficient, but at least, the linker will usually follow the
> rules of the x86 psABI, and relax the GOT load into a RIP-relative LEA
> instruction. This is still suboptimal, as the per-CPU load could use a
> RIP-relative reference directly, but at least it gets rid of the first
> load from memory.
>
> However, Boris reports that in some cases, when using distro builds of
> Clang/LLD 15, the first load gets relaxed into
>
> 49 c7 c6 20 c0 55 86 mov $0xffffffff8655c020,%r14
> ffffffff8373bf0f: R_X86_64_32S __ref_stack_chk_guard
> 65 49 8b 06 mov %gs:(%r14),%rax
>
> instead, which is fine in principle, as MOV may be cheaper than LEA on
> some micro-architectures. However, such absolute references assume that
> the variable in question can be accessed via the kernel virtual mapping,
> and this is not guaranteed for the startup code residing in .head.text.
>
> This is therefore a true positive, that was caught using the recently
> introduced relocs check for absolute references in the startup code:
>
> Absolute reference to symbol '__ref_stack_chk_guard' not permitted in .head.text
>
> Work around the issue by disabling the stack protector in the startup
> code for Clang versions older than 17.
>
> Fixes: 80d47defddc0 ("x86/stackprotector/64: Convert to normal per-CPU variable")
> Cc: Borislav Petkov <bp@alien8.de>
> Cc: Brian Gerst <brgerst@gmail.com>
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
> arch/x86/include/asm/init.h | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
> index 0e82ebc5d1e1..8b1b1abcef15 100644
> --- a/arch/x86/include/asm/init.h
> +++ b/arch/x86/include/asm/init.h
> @@ -2,7 +2,11 @@
> #ifndef _ASM_X86_INIT_H
> #define _ASM_X86_INIT_H
>
> +#if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
> +#define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector
> +#else
> #define __head __section(".head.text") __no_sanitize_undefined
> +#endif
Just disable it for all __head code. This runs long before userspace
can mount a stack smashing attack.
Brian Gerst
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code
2025-03-12 11:09 ` Brian Gerst
@ 2025-03-12 11:17 ` Ard Biesheuvel
0 siblings, 0 replies; 5+ messages in thread
From: Ard Biesheuvel @ 2025-03-12 11:17 UTC (permalink / raw)
To: Brian Gerst; +Cc: Ard Biesheuvel, linux-kernel, llvm, x86, Borislav Petkov
On Wed, 12 Mar 2025 at 12:09, Brian Gerst <brgerst@gmail.com> wrote:
>
> On Wed, Mar 12, 2025 at 6:27 AM Ard Biesheuvel <ardb+git@google.com> wrote:
> >
> > From: Ard Biesheuvel <ardb@kernel.org>
> >
> > Clang versions before 17 will not honour -fdirect-access-external-data
> > for the load of the stack cookie emitted into each function's prologue
> > and epilogue, and will emit a GOT based reference instead, e.g.,
> >
> > 4c 8b 2d 00 00 00 00 mov 0x0(%rip),%r13
> > 18a: R_X86_64_REX_GOTPCRELX __ref_stack_chk_guard-0x4
> > 65 49 8b 45 00 mov %gs:0x0(%r13),%rax
> >
> > This is inefficient, but at least, the linker will usually follow the
> > rules of the x86 psABI, and relax the GOT load into a RIP-relative LEA
> > instruction. This is still suboptimal, as the per-CPU load could use a
> > RIP-relative reference directly, but at least it gets rid of the first
> > load from memory.
> >
> > However, Boris reports that in some cases, when using distro builds of
> > Clang/LLD 15, the first load gets relaxed into
> >
> > 49 c7 c6 20 c0 55 86 mov $0xffffffff8655c020,%r14
> > ffffffff8373bf0f: R_X86_64_32S __ref_stack_chk_guard
> > 65 49 8b 06 mov %gs:(%r14),%rax
> >
> > instead, which is fine in principle, as MOV may be cheaper than LEA on
> > some micro-architectures. However, such absolute references assume that
> > the variable in question can be accessed via the kernel virtual mapping,
> > and this is not guaranteed for the startup code residing in .head.text.
> >
> > This is therefore a true positive, that was caught using the recently
> > introduced relocs check for absolute references in the startup code:
> >
> > Absolute reference to symbol '__ref_stack_chk_guard' not permitted in .head.text
> >
> > Work around the issue by disabling the stack protector in the startup
> > code for Clang versions older than 17.
> >
> > Fixes: 80d47defddc0 ("x86/stackprotector/64: Convert to normal per-CPU variable")
> > Cc: Borislav Petkov <bp@alien8.de>
> > Cc: Brian Gerst <brgerst@gmail.com>
> > Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> > ---
> > arch/x86/include/asm/init.h | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
> > index 0e82ebc5d1e1..8b1b1abcef15 100644
> > --- a/arch/x86/include/asm/init.h
> > +++ b/arch/x86/include/asm/init.h
> > @@ -2,7 +2,11 @@
> > #ifndef _ASM_X86_INIT_H
> > #define _ASM_X86_INIT_H
> >
> > +#if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
> > +#define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector
> > +#else
> > #define __head __section(".head.text") __no_sanitize_undefined
> > +#endif
>
> Just disable it for all __head code. This runs long before userspace
> can mount a stack smashing attack.
>
Not all of it - some code is emitted into .head.text because it is
called early, but it could still be called much later as well.
^ permalink raw reply [flat|nested] 5+ messages in thread
* [tip: x86/asm] x86/head/64: Avoid Clang < 17 stack protector in startup code
2025-03-12 10:27 [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code Ard Biesheuvel
2025-03-12 11:09 ` Brian Gerst
@ 2025-03-12 11:20 ` tip-bot2 for Ard Biesheuvel
2025-03-19 11:03 ` [tip: x86/core] " tip-bot2 for Ard Biesheuvel
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot2 for Ard Biesheuvel @ 2025-03-12 11:20 UTC (permalink / raw)
To: linux-tip-commits; +Cc: Borislav Petkov, Ard Biesheuvel, x86, linux-kernel
The following commit has been merged into the x86/asm branch of tip:
Commit-ID: 857716c8249ea9ada9d5657062833b6b5ef9fd63
Gitweb: https://git.kernel.org/tip/857716c8249ea9ada9d5657062833b6b5ef9fd63
Author: Ard Biesheuvel <ardb@kernel.org>
AuthorDate: Wed, 12 Mar 2025 11:27:41 +01:00
Committer: Borislav Petkov (AMD) <bp@alien8.de>
CommitterDate: Wed, 12 Mar 2025 12:08:10 +01:00
x86/head/64: Avoid Clang < 17 stack protector in startup code
Clang versions before 17 will not honour -fdirect-access-external-data
for the load of the stack cookie emitted into each function's prologue
and epilogue, and will emit a GOT based reference instead, e.g.,
4c 8b 2d 00 00 00 00 mov 0x0(%rip),%r13
18a: R_X86_64_REX_GOTPCRELX __ref_stack_chk_guard-0x4
65 49 8b 45 00 mov %gs:0x0(%r13),%rax
This is inefficient, but at least, the linker will usually follow the
rules of the x86 psABI, and relax the GOT load into a RIP-relative LEA
instruction. This is still suboptimal, as the per-CPU load could use a
RIP-relative reference directly, but at least it gets rid of the first
load from memory.
However, Boris reports that in some cases, when using distro builds of
Clang/LLD 15, the first load gets relaxed into
49 c7 c6 20 c0 55 86 mov $0xffffffff8655c020,%r14
ffffffff8373bf0f: R_X86_64_32S __ref_stack_chk_guard
65 49 8b 06 mov %gs:(%r14),%rax
instead, which is fine in principle, as MOV may be cheaper than LEA on
some micro-architectures. However, such absolute references assume that
the variable in question can be accessed via the kernel virtual mapping,
and this is not guaranteed for the startup code residing in .head.text.
This is therefore a true positive, that was caught using the recently
introduced relocs check for absolute references in the startup code:
Absolute reference to symbol '__ref_stack_chk_guard' not permitted in .head.text
Work around the issue by disabling the stack protector in the startup
code for Clang versions older than 17.
Fixes: 80d47defddc0 ("x86/stackprotector/64: Convert to normal per-CPU variable")
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20250312102740.602870-2-ardb+git@google.com
---
arch/x86/include/asm/init.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 0e82ebc..8b1b1ab 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -2,7 +2,11 @@
#ifndef _ASM_X86_INIT_H
#define _ASM_X86_INIT_H
+#if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
+#define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector
+#else
#define __head __section(".head.text") __no_sanitize_undefined
+#endif
struct x86_mapping_info {
void *(*alloc_pgt_page)(void *); /* allocate buf for page table */
^ permalink raw reply related [flat|nested] 5+ messages in thread
* [tip: x86/core] x86/head/64: Avoid Clang < 17 stack protector in startup code
2025-03-12 10:27 [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code Ard Biesheuvel
2025-03-12 11:09 ` Brian Gerst
2025-03-12 11:20 ` [tip: x86/asm] " tip-bot2 for Ard Biesheuvel
@ 2025-03-19 11:03 ` tip-bot2 for Ard Biesheuvel
2 siblings, 0 replies; 5+ messages in thread
From: tip-bot2 for Ard Biesheuvel @ 2025-03-19 11:03 UTC (permalink / raw)
To: linux-tip-commits
Cc: Borislav Petkov, Ard Biesheuvel, Ingo Molnar, x86, linux-kernel
The following commit has been merged into the x86/core branch of tip:
Commit-ID: 3f5dbafc2d4651020f45309ca85120b6a8162fd9
Gitweb: https://git.kernel.org/tip/3f5dbafc2d4651020f45309ca85120b6a8162fd9
Author: Ard Biesheuvel <ardb@kernel.org>
AuthorDate: Wed, 12 Mar 2025 11:27:41 +01:00
Committer: Ingo Molnar <mingo@kernel.org>
CommitterDate: Wed, 19 Mar 2025 11:26:49 +01:00
x86/head/64: Avoid Clang < 17 stack protector in startup code
Clang versions before 17 will not honour -fdirect-access-external-data
for the load of the stack cookie emitted into each function's prologue
and epilogue, and will emit a GOT based reference instead, e.g.,
4c 8b 2d 00 00 00 00 mov 0x0(%rip),%r13
18a: R_X86_64_REX_GOTPCRELX __ref_stack_chk_guard-0x4
65 49 8b 45 00 mov %gs:0x0(%r13),%rax
This is inefficient, but at least, the linker will usually follow the
rules of the x86 psABI, and relax the GOT load into a RIP-relative LEA
instruction. This is still suboptimal, as the per-CPU load could use a
RIP-relative reference directly, but at least it gets rid of the first
load from memory.
However, Boris reports that in some cases, when using distro builds of
Clang/LLD 15, the first load gets relaxed into
49 c7 c6 20 c0 55 86 mov $0xffffffff8655c020,%r14
ffffffff8373bf0f: R_X86_64_32S __ref_stack_chk_guard
65 49 8b 06 mov %gs:(%r14),%rax
instead, which is fine in principle, as MOV may be cheaper than LEA on
some micro-architectures. However, such absolute references assume that
the variable in question can be accessed via the kernel virtual mapping,
and this is not guaranteed for the startup code residing in .head.text.
This is therefore a true positive, that was caught using the recently
introduced relocs check for absolute references in the startup code:
Absolute reference to symbol '__ref_stack_chk_guard' not permitted in .head.text
Work around the issue by disabling the stack protector in the startup
code for Clang versions older than 17.
Fixes: 80d47defddc0 ("x86/stackprotector/64: Convert to normal per-CPU variable")
Reported-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Link: https://lore.kernel.org/r/20250312102740.602870-2-ardb+git@google.com
---
arch/x86/include/asm/init.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h
index 0e82ebc..8b1b1ab 100644
--- a/arch/x86/include/asm/init.h
+++ b/arch/x86/include/asm/init.h
@@ -2,7 +2,11 @@
#ifndef _ASM_X86_INIT_H
#define _ASM_X86_INIT_H
+#if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000
+#define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector
+#else
#define __head __section(".head.text") __no_sanitize_undefined
+#endif
struct x86_mapping_info {
void *(*alloc_pgt_page)(void *); /* allocate buf for page table */
^ permalink raw reply related [flat|nested] 5+ messages in thread
end of thread, other threads:[~2025-03-19 11:03 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-03-12 10:27 [PATCH] x86/head/64: Avoid Clang < 17 stack protector in startup code Ard Biesheuvel
2025-03-12 11:09 ` Brian Gerst
2025-03-12 11:17 ` Ard Biesheuvel
2025-03-12 11:20 ` [tip: x86/asm] " tip-bot2 for Ard Biesheuvel
2025-03-19 11:03 ` [tip: x86/core] " tip-bot2 for Ard Biesheuvel
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.