From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0963111A8; Tue, 29 Jul 2025 23:19:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753831162; cv=none; b=oj8bCS1fTu1fnbKDkgCvbi9Uj5+Xz85bMs9GXqleZ9AZbyw5HLyy43Z18ZAzqAxDNmDBsofySUYEzjpSIbgiB+PY29eflIi+NNFm+NvDhWdt+xNconxDLiRQXfqk4WqgB+n+r0xeSzlyTOY9YbUvnQG+a1doAQkVua5mnGzge/g= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1753831162; c=relaxed/simple; bh=6wOezsch67WwQVNo5tzv6Hbsz/dH8RKG8/l141P3N0M=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=H4Is1yhjirkUPX1w/04tU1VviKTG3Jw0O3yUs1Lx721K69sYUdfRReGTJLb2qhtflyvp0957S0UGy5L/OIcMHGL40LguAYmQkX9sVnR6Jl5G/2rR39pVe7n5V5SBB4v9cU3FDcJXO1a2SaIS5xczeR1k4CZUwokgi8bYAOm9dGA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lbHBejxl; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lbHBejxl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D628C4CEEF; Tue, 29 Jul 2025 23:19:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1753831160; bh=6wOezsch67WwQVNo5tzv6Hbsz/dH8RKG8/l141P3N0M=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=lbHBejxlHeq5firbzsiMgx5MLnMxXrDyNQxM07GuE9/ZGMLcFqnh+Z+XAeNSPtm0q 8QmJsncEDQnBOmRqFiXzYZkDYLh/Ja7F0HZ6tAXpShAD/XN+5dP+bKIiKTcXnICqJx j2D0/tpxlylHe/3m2Cox9AtecdBCVVOrbDRh91Qypvjx575Twu3SZFB/vYHhtMVPaC pUsKLpA+L7JcSQwqcnnxMY8cenK/jWmpKSp24PnPiQsDVDFqHuRibrGEUxnLnod//4 whSxK1jHf1CIamTSZt+oW6UZ2HPlJPe/sSyQRR5fTrm4ZPup4F2BbV/A8/GJK/fR8b ihYwaOgv4Rcfg== Date: Tue, 29 Jul 2025 16:19:20 -0700 From: Kees Cook To: Marco Elver Cc: Linus Torvalds , kernel test robot , syzbot+5245cb609175fb6e8122@syzkaller.appspotmail.com, Thomas Gleixner , Ingo Molnar , Borislav Petkov , Dave Hansen , x86@kernel.org, "H. Peter Anvin" , Ard Biesheuvel , Hou Wenlong , "Kirill A . Shutemov" , Miguel Ojeda , Nathan Chancellor , Przemek Kitszel , Andrew Morton , Masahiro Yamada , Peter Zijlstra , Wei Yang , Sami Tolvanen , Arnd Bergmann , Christophe Leroy , Nick Desaulniers , Bill Wendling , Justin Stitt , Michael Kelley , Marc Herbert , Yafang Shao , Uros Bizjak , Jan Hendrik Farr , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-hardening@vger.kernel.org Subject: Re: [PATCH] compiler_types: Provide __no_kstack_erase to disable coverage only on Clang Message-ID: <202507291618.8B04B08@keescook> References: <20250729224325.work.019-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-hardening@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Wed, Jul 30, 2025 at 01:00:39AM +0200, Marco Elver wrote: > On Wed, 30 Jul 2025 at 00:43, Kees Cook wrote: > > > > In order to support Clang's stack depth tracking (for Linux's kstack_erase > > feature), the coverage sanitizer needed to be disabled for __init (and > > __head) section code. Doing this universally (i.e. for GCC too), created > > a number of unexpected problems, ranging from changes to inlining logic > > to failures to DCE code on earlier GCC versions. > > > > Since this change is only needed for Clang, specialize it so that GCC > > doesn't see the change as it isn't needed there (the GCC implementation > > of kstack_erase uses a GCC plugin that removes stack depth tracking > > instrumentation from __init sections during a late pass in the IR). > > > > Successful build and boot tested with GCC 12 and Clang 22. > > > > Fixes: 381a38ea53d2 ("init.h: Disable sanitizer coverage for __init and __head") > > Reported-by: kernel test robot > > Closes: https://lore.kernel.org/oe-kbuild-all/202507270258.neWuiXLd-lkp@intel.com/ > > Reported-by: syzbot+5245cb609175fb6e8122@syzkaller.appspotmail.com > > Closes: https://lore.kernel.org/all/6888d004.a00a0220.26d0e1.0004.GAE@google.com/ > > Signed-off-by: Kees Cook > > --- > > Cc: Linus Torvalds > > Cc: Thomas Gleixner > > Cc: Ingo Molnar > > Cc: Borislav Petkov > > Cc: Dave Hansen > > Cc: > > Cc: "H. Peter Anvin" > > Cc: Ard Biesheuvel > > Cc: Marco Elver > > Cc: Hou Wenlong > > Cc: Kirill A. Shutemov > > Cc: Miguel Ojeda > > Cc: Nathan Chancellor > > Cc: Przemek Kitszel > > Cc: Andrew Morton > > Cc: Masahiro Yamada > > Cc: Peter Zijlstra > > Cc: Wei Yang > > Cc: Sami Tolvanen > > Cc: Arnd Bergmann > > Cc: Christophe Leroy > > --- > > arch/x86/include/asm/init.h | 2 +- > > include/linux/compiler_types.h | 7 +++++++ > > include/linux/init.h | 2 +- > > 3 files changed, 9 insertions(+), 2 deletions(-) > > > > diff --git a/arch/x86/include/asm/init.h b/arch/x86/include/asm/init.h > > index 6bfdaeddbae8..5a68e9db6518 100644 > > --- a/arch/x86/include/asm/init.h > > +++ b/arch/x86/include/asm/init.h > > @@ -5,7 +5,7 @@ > > #if defined(CONFIG_CC_IS_CLANG) && CONFIG_CLANG_VERSION < 170000 > > #define __head __section(".head.text") __no_sanitize_undefined __no_stack_protector > > #else > > -#define __head __section(".head.text") __no_sanitize_undefined __no_sanitize_coverage > > +#define __head __section(".head.text") __no_sanitize_undefined __no_kstack_erase > > #endif > > > > struct x86_mapping_info { > > diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h > > index 2b77d12e07b2..89e2c01fc8b1 100644 > > --- a/include/linux/compiler_types.h > > +++ b/include/linux/compiler_types.h > > @@ -378,6 +378,13 @@ struct ftrace_likely_data { > > # define __signed_wrap > > #endif > > > > +/* GCC does not like splitting sanitizer coverage across section inlines */ > > +#ifdef CC_IS_CLANG > > +#define __no_kstack_erase __no_sanitize_coverage > > +#else > > +#define __no_kstack_erase > > +#endif > > I think this belongs into compiler-clang.h, we've typically refrained > from ifdef CC_IS_CLANG/GCC in the generic headers. > See __nocfi for an example, where compiler_types.h provides a default > empty definition, and compiler-clang.h provides a non-empty > definition. Oh, good point. I will rearrange this to use the #ifndef style handling! -- Kees Cook