public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <kees@kernel.org>
To: Mark Brown <broonie@kernel.org>
Cc: "Linus Torvalds" <torvalds@linux-foundation.org>,
	"Mickaël Salaün" <mic@digikod.net>,
	"Günther Noack" <gnoack@google.com>,
	"Arnd Bergmann" <arnd@arndb.de>,
	linux-hardening@vger.kernel.org, linux-kernel@vger.kernel.org,
	linux-security-module@vger.kernel.org
Subject: Re: [PATCH] gcc-plugins: Disable GCC plugins for compile test builds
Date: Tue, 8 Apr 2025 16:32:24 -0700	[thread overview]
Message-ID: <202504081630.4CE88E855@keescook> (raw)
In-Reply-To: <20250407-kbuild-disable-gcc-plugins-v1-1-5d46ae583f5e@kernel.org>

On Mon, Apr 07, 2025 at 09:57:32PM +0100, Mark Brown wrote:
> In current mainline x86_64 allmodconfig builds done with tuxmake GCC 13
> and GCC 14 toolchains (which are Debian ones packaged up into containers)
> generate ICEs in landlock:
> 
> Event                            | Plugins
> PLUGIN_FINISH_TYPE               | randomize_layout_plugin
> PLUGIN_FINISH_DECL               | randomize_layout_plugin
> PLUGIN_ATTRIBUTES                | latent_entropy_plugin randomize_layout_plugin
> PLUGIN_START_UNIT                | latent_entropy_plugin stackleak_plugin
> PLUGIN_ALL_IPA_PASSES_START      | randomize_layout_plugin
> /build/stage/linux/security/landlock/fs.c: In function ‘hook_file_ioctl_common’:
> /build/stage/linux/security/landlock/fs.c:1745:61: internal compiler error: in c
> ount_type_elements, at expr.cc:7075
>  1745 |                         .u.op = &(struct lsm_ioctlop_audit) {
>       |                                                             ^
> 
> Arnd bisected this to c56f649646ec ("landlock: Log mount-related
> denials") but that commit is fairly obviously not really at fault here,
> most likely this is an issue in the plugin.  Given how disruptive having
> key configs like this failing let's disable the plugins for compile test
> builds until a fix is found.

Looks like this is a randstruct bug. We'll need to disable that one for
now (rather than all plugins).

I can reproduce this for GCC 14, but I can't reproduce this with GCC
13. Which minor release is failing for you? My GCC 13 is:
gcc (Ubuntu 13.3.0-6ubuntu2~24.04) 13.3.0

-Kees

-- 
Kees Cook

  parent reply	other threads:[~2025-04-08 23:32 UTC|newest]

Thread overview: 19+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-04-07 20:57 [PATCH] gcc-plugins: Disable GCC plugins for compile test builds Mark Brown
2025-04-07 21:33 ` Linus Torvalds
2025-04-07 22:02   ` Mark Brown
2025-04-08  9:22     ` Arnd Bergmann
2025-04-08 20:37       ` Kees Cook
2025-04-10  7:58         ` Arnd Bergmann
2025-04-08 23:32 ` Kees Cook [this message]
2025-04-09  5:43   ` Arnd Bergmann
2025-04-09 12:19   ` Mark Brown
2025-04-09 15:33     ` Linus Torvalds
2025-04-09 17:29       ` Mark Brown
2025-04-09 17:42         ` Linus Torvalds
2025-04-09 17:46           ` Kees Cook
2025-04-09 18:09           ` Mark Brown
2025-04-09 19:24             ` Arnd Bergmann
2025-04-15 20:26 ` Palmer Dabbelt
2025-04-15 20:41   ` Mark Brown
2025-04-15 20:43     ` Kees Cook
2025-04-15 20:41   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=202504081630.4CE88E855@keescook \
    --to=kees@kernel.org \
    --cc=arnd@arndb.de \
    --cc=broonie@kernel.org \
    --cc=gnoack@google.com \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=mic@digikod.net \
    --cc=torvalds@linux-foundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox