[0/1] Fix CFI hash randomization with KASAN

Message ID	20230112224948.1479453-1-samitolvanen@google.com (mailing list archive)
Headers	show Return-Path: <linux-kbuild-owner@vger.kernel.org> Date: Thu, 12 Jan 2023 22:49:47 +0000 Mime-Version: 1.0 Message-ID: <20230112224948.1479453-1-samitolvanen@google.com> Subject: [PATCH 0/1] Fix CFI hash randomization with KASAN From: Sami Tolvanen <samitolvanen@google.com> To: "Peter Zijlstra (Intel)" <peterz@infradead.org>, Masahiro Yamada <masahiroy@kernel.org> Cc: Nathan Chancellor <nathan@kernel.org>, Nick Desaulniers <ndesaulniers@google.com>, Kees Cook <keescook@chromium.org>, linux-kbuild@vger.kernel.org, llvm@lists.linux.dev, linux-kernel@vger.kernel.org, Sami Tolvanen <samitolvanen@google.com> Content-Type: text/plain; charset="UTF-8" Precedence: bulk
Series	Fix CFI hash randomization with KASAN \| expand [0/1] Fix CFI hash randomization with KASAN [1/1] kbuild: Fix CFI hash randomization with KASAN

Message ID

20230112224948.1479453-1-samitolvanen@google.com (mailing list archive)

Headers

Date: Thu, 12 Jan 2023 22:49:47 +0000
Mime-Version: 1.0
Message-ID: <20230112224948.1479453-1-samitolvanen@google.com>
Subject: [PATCH 0/1] Fix CFI hash randomization with KASAN
From: Sami Tolvanen <samitolvanen@google.com>
To: "Peter Zijlstra (Intel)" <peterz@infradead.org>,
        Masahiro Yamada <masahiroy@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>,
        Nick Desaulniers <ndesaulniers@google.com>,
        Kees Cook <keescook@chromium.org>,
        linux-kbuild@vger.kernel.org, llvm@lists.linux.dev,
        linux-kernel@vger.kernel.org,
        Sami Tolvanen <samitolvanen@google.com>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

Series

Fix CFI hash randomization with KASAN | expand

Message

Sami Tolvanen Jan. 12, 2023, 10:49 p.m. UTC

Peter, Masahiro,

I noticed that KASAN+CFI fails to boot on x86_64 without
cfi=norand. The randomization code is missing a couple of KASAN
constructors in object files that are not part of vmlinux.o. This
happens because we don't run objtool for the files, which means
the type hashes are not included in the .cfi_sites section.

This patch simply disables KASAN for these files, which seems
reasonable to me and fixes the boot issue, but perhaps you have
better ideas?

Sami


Sami Tolvanen (1):
  kbuild: Fix CFI hash randomization with KASAN

 init/Makefile            | 1 +
 scripts/Makefile.vmlinux | 1 +
 2 files changed, 2 insertions(+)


base-commit: c757fc92a3f73734872c7793b97f06434773d65d

Comments

Kees Cook Jan. 13, 2023, 11:15 p.m. UTC | #1

On Thu, 12 Jan 2023 22:49:47 +0000, Sami Tolvanen wrote:
> Peter, Masahiro,
> 
> I noticed that KASAN+CFI fails to boot on x86_64 without
> cfi=norand. The randomization code is missing a couple of KASAN
> constructors in object files that are not part of vmlinux.o. This
> happens because we don't run objtool for the files, which means
> the type hashes are not included in the .cfi_sites section.
> 
> [...]

Applied to for-linus/hardening, thanks!

[1/1] kbuild: Fix CFI hash randomization with KASAN
      https://git.kernel.org/kees/c/a6c5a3491b3f