Date: Wednesday, May 20, 2020 @ 22:56:30 Author: heftig Revision: 387042
5.4.42-1 Added: linux-lts/trunk/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch (from rev 383366, linux-lts/trunk/0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch) linux-lts/trunk/0002-gcc-common.h-Update-for-GCC-10.patch (from rev 383366, linux-lts/trunk/0001-gcc-common.h-Update-for-GCC-10.patch) Modified: linux-lts/trunk/PKGBUILD Deleted: linux-lts/trunk/0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch linux-lts/trunk/0001-gcc-common.h-Update-for-GCC-10.patch linux-lts/trunk/0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch linux-lts/trunk/0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch -----------------------------------------------------------------+ 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch | 132 ++++++++++ 0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch | 132 ---------- 0001-gcc-common.h-Update-for-GCC-10.patch | 92 ------ 0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch | 32 -- 0002-gcc-common.h-Update-for-GCC-10.patch | 92 ++++++ 0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch | 131 --------- PKGBUILD | 16 - 7 files changed, 230 insertions(+), 397 deletions(-) Copied: linux-lts/trunk/0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch (from rev 383366, linux-lts/trunk/0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch) =================================================================== --- 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch (rev 0) +++ 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -0,0 +1,132 @@ +From f4b254de5d2b75143dd7c225e58afb3f5ee3bae6 Mon Sep 17 00:00:00 2001 +From: "Jan Alexander Steffens (heftig)" <jan.steff...@gmail.com> +Date: Mon, 16 Sep 2019 04:53:20 +0200 +Subject: [PATCH] ZEN: Add sysctl and CONFIG to disallow unprivileged + CLONE_NEWUSER + +Our default behavior continues to match the vanilla kernel. +--- + init/Kconfig | 16 ++++++++++++++++ + kernel/fork.c | 15 +++++++++++++++ + kernel/sysctl.c | 12 ++++++++++++ + kernel/user_namespace.c | 7 +++++++ + 4 files changed, 50 insertions(+) + +diff --git a/init/Kconfig b/init/Kconfig +index 6db3e310a5e4..2dd7dd1b6b0d 100644 +--- a/init/Kconfig ++++ b/init/Kconfig +@@ -1083,6 +1083,22 @@ config USER_NS + + If unsure, say N. + ++config USER_NS_UNPRIVILEGED ++ bool "Allow unprivileged users to create namespaces" ++ default y ++ depends on USER_NS ++ help ++ When disabled, unprivileged users will not be able to create ++ new namespaces. Allowing users to create their own namespaces ++ has been part of several recent local privilege escalation ++ exploits, so if you need user namespaces but are ++ paranoid^Wsecurity-conscious you want to disable this. ++ ++ This setting can be overridden at runtime via the ++ kernel.unprivileged_userns_clone sysctl. ++ ++ If unsure, say Y. ++ + config PID_NS + bool "PID Namespaces" + default y +diff --git a/kernel/fork.c b/kernel/fork.c +index 9180f4416dba..a02f83b1d9b4 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -106,6 +106,11 @@ + + #define CREATE_TRACE_POINTS + #include <trace/events/task.h> ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#else ++#define unprivileged_userns_clone 0 ++#endif + + /* + * Minimum number of threads to boot the kernel +@@ -1779,6 +1784,10 @@ static __latent_entropy struct task_struct *copy_process( + if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) + return ERR_PTR(-EINVAL); + ++ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) ++ if (!capable(CAP_SYS_ADMIN)) ++ return ERR_PTR(-EPERM); ++ + /* + * Thread groups must share signals as well, and detached threads + * can only be started up within the thread group. +@@ -2837,6 +2846,12 @@ int ksys_unshare(unsigned long unshare_flags) + if (unshare_flags & CLONE_NEWNS) + unshare_flags |= CLONE_FS; + ++ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { ++ err = -EPERM; ++ if (!capable(CAP_SYS_ADMIN)) ++ goto bad_unshare_out; ++ } ++ + err = check_unshare_flags(unshare_flags); + if (err) + goto bad_unshare_out; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 70665934d53e..9797869ed829 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -110,6 +110,9 @@ extern int core_uses_pid; + extern char core_pattern[]; + extern unsigned int core_pipe_limit; + #endif ++#ifdef CONFIG_USER_NS ++extern int unprivileged_userns_clone; ++#endif + extern int pid_max; + extern int pid_max_min, pid_max_max; + extern int percpu_pagelist_fraction; +@@ -546,6 +549,15 @@ static struct ctl_table kern_table[] = { + .proc_handler = proc_dointvec, + }, + #endif ++#ifdef CONFIG_USER_NS ++ { ++ .procname = "unprivileged_userns_clone", ++ .data = &unprivileged_userns_clone, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec, ++ }, ++#endif + #ifdef CONFIG_PROC_SYSCTL + { + .procname = "tainted", +diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c +index 8eadadc478f9..c36ecd19562c 100644 +--- a/kernel/user_namespace.c ++++ b/kernel/user_namespace.c +@@ -21,6 +21,13 @@ + #include <linux/bsearch.h> + #include <linux/sort.h> + ++/* sysctl */ ++#ifdef CONFIG_USER_NS_UNPRIVILEGED ++int unprivileged_userns_clone = 1; ++#else ++int unprivileged_userns_clone; ++#endif ++ + static struct kmem_cache *user_ns_cachep __read_mostly; + static DEFINE_MUTEX(userns_state_mutex); + +-- +2.26.2 + Deleted: 0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch =================================================================== --- 0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch 2020-05-20 22:56:10 UTC (rev 387041) +++ 0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -1,132 +0,0 @@ -From 6136ffb3d88e9f044260f8288d2d0a1edd64379e Mon Sep 17 00:00:00 2001 -From: "Jan Alexander Steffens (heftig)" <jan.steff...@gmail.com> -Date: Mon, 16 Sep 2019 04:53:20 +0200 -Subject: [PATCH] ZEN: Add sysctl and CONFIG to disallow unprivileged - CLONE_NEWUSER - -Our default behavior continues to match the vanilla kernel. ---- - init/Kconfig | 16 ++++++++++++++++ - kernel/fork.c | 15 +++++++++++++++ - kernel/sysctl.c | 12 ++++++++++++ - kernel/user_namespace.c | 7 +++++++ - 4 files changed, 50 insertions(+) - -diff --git a/init/Kconfig b/init/Kconfig -index bd7d650d4a99..658f9c052151 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1091,6 +1091,22 @@ config USER_NS - - If unsure, say N. - -+config USER_NS_UNPRIVILEGED -+ bool "Allow unprivileged users to create namespaces" -+ default y -+ depends on USER_NS -+ help -+ When disabled, unprivileged users will not be able to create -+ new namespaces. Allowing users to create their own namespaces -+ has been part of several recent local privilege escalation -+ exploits, so if you need user namespaces but are -+ paranoid^Wsecurity-conscious you want to disable this. -+ -+ This setting can be overridden at runtime via the -+ kernel.unprivileged_userns_clone sysctl. -+ -+ If unsure, say Y. -+ - config PID_NS - bool "PID Namespaces" - default y -diff --git a/kernel/fork.c b/kernel/fork.c -index 541fd805fb88..ffd57c812153 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -106,6 +106,11 @@ - - #define CREATE_TRACE_POINTS - #include <trace/events/task.h> -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#else -+#define unprivileged_userns_clone 0 -+#endif - - /* - * Minimum number of threads to boot the kernel -@@ -1788,6 +1793,10 @@ static __latent_entropy struct task_struct *copy_process( - if ((clone_flags & (CLONE_NEWUSER|CLONE_FS)) == (CLONE_NEWUSER|CLONE_FS)) - return ERR_PTR(-EINVAL); - -+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) -+ if (!capable(CAP_SYS_ADMIN)) -+ return ERR_PTR(-EPERM); -+ - /* - * Thread groups must share signals as well, and detached threads - * can only be started up within the thread group. -@@ -2819,6 +2828,12 @@ int ksys_unshare(unsigned long unshare_flags) - if (unshare_flags & CLONE_NEWNS) - unshare_flags |= CLONE_FS; - -+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { -+ err = -EPERM; -+ if (!capable(CAP_SYS_ADMIN)) -+ goto bad_unshare_out; -+ } -+ - err = check_unshare_flags(unshare_flags); - if (err) - goto bad_unshare_out; -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 078950d9605b..baead3605bbe 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -110,6 +110,9 @@ extern int core_uses_pid; - extern char core_pattern[]; - extern unsigned int core_pipe_limit; - #endif -+#ifdef CONFIG_USER_NS -+extern int unprivileged_userns_clone; -+#endif - extern int pid_max; - extern int pid_max_min, pid_max_max; - extern int percpu_pagelist_fraction; -@@ -545,6 +548,15 @@ static struct ctl_table kern_table[] = { - .proc_handler = proc_dointvec, - }, - #endif -+#ifdef CONFIG_USER_NS -+ { -+ .procname = "unprivileged_userns_clone", -+ .data = &unprivileged_userns_clone, -+ .maxlen = sizeof(int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec, -+ }, -+#endif - #ifdef CONFIG_PROC_SYSCTL - { - .procname = "tainted", -diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c -index 8eadadc478f9..c36ecd19562c 100644 ---- a/kernel/user_namespace.c -+++ b/kernel/user_namespace.c -@@ -21,6 +21,13 @@ - #include <linux/bsearch.h> - #include <linux/sort.h> - -+/* sysctl */ -+#ifdef CONFIG_USER_NS_UNPRIVILEGED -+int unprivileged_userns_clone = 1; -+#else -+int unprivileged_userns_clone; -+#endif -+ - static struct kmem_cache *user_ns_cachep __read_mostly; - static DEFINE_MUTEX(userns_state_mutex); - --- -2.23.0 - Deleted: 0001-gcc-common.h-Update-for-GCC-10.patch =================================================================== --- 0001-gcc-common.h-Update-for-GCC-10.patch 2020-05-20 22:56:10 UTC (rev 387041) +++ 0001-gcc-common.h-Update-for-GCC-10.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -1,92 +0,0 @@ -From 1a84040203e73d1bccfdb99aed98042efe3ecd16 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Pierret=20=28fepitre=29?= - <frederic.pier...@qubes-os.org> -Date: Tue, 7 Apr 2020 13:32:59 +0200 -Subject: [PATCH 1/3] gcc-common.h: Update for GCC 10 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Remove "params.h" include, which has been dropped in GCC 10. - -Remove is_a_helper() macro, which is now defined in gimple.h, as seen -when running './scripts/gcc-plugin.sh g++ g++ gcc': - -In file included from <stdin>:1: -./gcc-plugins/gcc-common.h:852:13: error: redefinition of ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ - 852 | inline bool is_a_helper<const ggoto *>::test(const_gimple gs) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~ -In file included from ./gcc-plugins/gcc-common.h:125, - from <stdin>:1: -/usr/lib/gcc/x86_64-redhat-linux/10/plugin/include/gimple.h:1037:1: note: ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ previously declared here - 1037 | is_a_helper <const ggoto *>::test (const gimple *gs) - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Add -Wno-format-diag to scripts/gcc-plugins/Makefile to avoid -meaningless warnings from error() formats used by plugins: - -scripts/gcc-plugins/structleak_plugin.c: In function ‘int plugin_init(plugin_name_args*, plugin_gcc_version*)’: -scripts/gcc-plugins/structleak_plugin.c:253:12: warning: unquoted sequence of 2 consecutive punctuation characters ‘'-’ in format [-Wformat-diag] - 253 | error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); - | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ - -Signed-off-by: Frédéric Pierret (fepitre) <frederic.pier...@qubes-os.org> -Link: https://lore.kernel.org/r/20200407113259.270172-1-frederic.pier...@qubes-os.org -[kees: include -Wno-format-diag for plugin builds] -Signed-off-by: Kees Cook <keesc...@chromium.org> ---- - scripts/gcc-plugins/Makefile | 1 + - scripts/gcc-plugins/gcc-common.h | 4 ++++ - 2 files changed, 5 insertions(+) - -diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile -index aa0d0ec6936d..9e95862f2788 100644 ---- a/scripts/gcc-plugins/Makefile -+++ b/scripts/gcc-plugins/Makefile -@@ -11,6 +11,7 @@ else - HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti - HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb - HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable -+ HOST_EXTRACXXFLAGS += -Wno-format-diag - export HOST_EXTRACXXFLAGS - endif - -diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h -index 17f06079a712..9ad76b7f3f10 100644 ---- a/scripts/gcc-plugins/gcc-common.h -+++ b/scripts/gcc-plugins/gcc-common.h -@@ -35,7 +35,9 @@ - #include "ggc.h" - #include "timevar.h" - -+#if BUILDING_GCC_VERSION < 10000 - #include "params.h" -+#endif - - #if BUILDING_GCC_VERSION <= 4009 - #include "pointer-set.h" -@@ -847,19 +849,21 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l - return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT); - } - -+#if BUILDING_GCC_VERSION < 10000 - template <> - template <> - inline bool is_a_helper<const ggoto *>::test(const_gimple gs) - { - return gs->code == GIMPLE_GOTO; - } - - template <> - template <> - inline bool is_a_helper<const greturn *>::test(const_gimple gs) - { - return gs->code == GIMPLE_RETURN; - } -+#endif - - static inline gasm *as_a_gasm(gimple stmt) - { --- -2.26.2 - Deleted: 0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch =================================================================== --- 0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch 2020-05-20 22:56:10 UTC (rev 387041) +++ 0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -1,32 +0,0 @@ -From 6a183a41a1945cb79660a78536182ce9c2568291 Mon Sep 17 00:00:00 2001 -From: Sergei Trofimovich <sly...@gentoo.org> -Date: Tue, 17 Mar 2020 00:07:18 +0000 -Subject: [PATCH 2/3] Makefile: disallow data races on gcc-10 as well - -gcc-10 will rename --param=allow-store-data-races=0 -to -fno-allow-store-data-races. - -The flag change happened at https://gcc.gnu.org/PR92046. - -Signed-off-by: Sergei Trofimovich <sly...@gentoo.org> -Acked-by: Jiri Kosina <jkos...@suse.cz> -Signed-off-by: Masahiro Yamada <masahi...@kernel.org> ---- - Makefile | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/Makefile b/Makefile -index ff2b90ddc9bc..c8dc1357079b 100644 ---- a/Makefile -+++ b/Makefile -@@ -713,6 +713,7 @@ endif - - # Tell gcc to never replace conditional load with a non-conditional one - KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) -+KBUILD_CFLAGS += $(call cc-option,-fno-allow-store-data-races) - - include scripts/Makefile.kcov - include scripts/Makefile.gcc-plugins --- -2.26.2 - Copied: linux-lts/trunk/0002-gcc-common.h-Update-for-GCC-10.patch (from rev 383366, linux-lts/trunk/0001-gcc-common.h-Update-for-GCC-10.patch) =================================================================== --- 0002-gcc-common.h-Update-for-GCC-10.patch (rev 0) +++ 0002-gcc-common.h-Update-for-GCC-10.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -0,0 +1,92 @@ +From 3651deb9b0421f9f3f88d95c9be02b15517927cf Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Pierret=20=28fepitre=29?= + <frederic.pier...@qubes-os.org> +Date: Tue, 7 Apr 2020 13:32:59 +0200 +Subject: [PATCH] gcc-common.h: Update for GCC 10 +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Remove "params.h" include, which has been dropped in GCC 10. + +Remove is_a_helper() macro, which is now defined in gimple.h, as seen +when running './scripts/gcc-plugin.sh g++ g++ gcc': + +In file included from <stdin>:1: +./gcc-plugins/gcc-common.h:852:13: error: redefinition of ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ + 852 | inline bool is_a_helper<const ggoto *>::test(const_gimple gs) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~ +In file included from ./gcc-plugins/gcc-common.h:125, + from <stdin>:1: +/usr/lib/gcc/x86_64-redhat-linux/10/plugin/include/gimple.h:1037:1: note: ‘static bool is_a_helper<T>::test(U*) [with U = const gimple; T = const ggoto*]’ previously declared here + 1037 | is_a_helper <const ggoto *>::test (const gimple *gs) + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Add -Wno-format-diag to scripts/gcc-plugins/Makefile to avoid +meaningless warnings from error() formats used by plugins: + +scripts/gcc-plugins/structleak_plugin.c: In function ‘int plugin_init(plugin_name_args*, plugin_gcc_version*)’: +scripts/gcc-plugins/structleak_plugin.c:253:12: warning: unquoted sequence of 2 consecutive punctuation characters ‘'-’ in format [-Wformat-diag] + 253 | error(G_("unknown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key); + | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +Signed-off-by: Frédéric Pierret (fepitre) <frederic.pier...@qubes-os.org> +Link: https://lore.kernel.org/r/20200407113259.270172-1-frederic.pier...@qubes-os.org +[kees: include -Wno-format-diag for plugin builds] +Signed-off-by: Kees Cook <keesc...@chromium.org> +--- + scripts/gcc-plugins/Makefile | 1 + + scripts/gcc-plugins/gcc-common.h | 4 ++++ + 2 files changed, 5 insertions(+) + +diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile +index aa0d0ec6936d..9e95862f2788 100644 +--- a/scripts/gcc-plugins/Makefile ++++ b/scripts/gcc-plugins/Makefile +@@ -11,6 +11,7 @@ else + HOST_EXTRACXXFLAGS += -I$(GCC_PLUGINS_DIR)/include -I$(src) -std=gnu++98 -fno-rtti + HOST_EXTRACXXFLAGS += -fno-exceptions -fasynchronous-unwind-tables -ggdb + HOST_EXTRACXXFLAGS += -Wno-narrowing -Wno-unused-variable ++ HOST_EXTRACXXFLAGS += -Wno-format-diag + export HOST_EXTRACXXFLAGS + endif + +diff --git a/scripts/gcc-plugins/gcc-common.h b/scripts/gcc-plugins/gcc-common.h +index 17f06079a712..9ad76b7f3f10 100644 +--- a/scripts/gcc-plugins/gcc-common.h ++++ b/scripts/gcc-plugins/gcc-common.h +@@ -35,7 +35,9 @@ + #include "ggc.h" + #include "timevar.h" + ++#if BUILDING_GCC_VERSION < 10000 + #include "params.h" ++#endif + + #if BUILDING_GCC_VERSION <= 4009 + #include "pointer-set.h" +@@ -847,19 +849,21 @@ static inline gimple gimple_build_assign_with_ops(enum tree_code subcode, tree l + return gimple_build_assign(lhs, subcode, op1, op2 PASS_MEM_STAT); + } + ++#if BUILDING_GCC_VERSION < 10000 + template <> + template <> + inline bool is_a_helper<const ggoto *>::test(const_gimple gs) + { + return gs->code == GIMPLE_GOTO; + } + + template <> + template <> + inline bool is_a_helper<const greturn *>::test(const_gimple gs) + { + return gs->code == GIMPLE_RETURN; + } ++#endif + + static inline gasm *as_a_gasm(gimple stmt) + { +-- +2.26.2 + Deleted: 0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch =================================================================== --- 0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch 2020-05-20 22:56:10 UTC (rev 387041) +++ 0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch 2020-05-20 22:56:30 UTC (rev 387042) @@ -1,131 +0,0 @@ -From 2f18ace75890ccd9681f210efdb58662db0cb4c4 Mon Sep 17 00:00:00 2001 -From: Borislav Petkov <b...@suse.de> -Date: Wed, 22 Apr 2020 18:11:30 +0200 -Subject: [PATCH 3/3] x86: Fix early boot crash on gcc-10, next try -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -... or the odyssey of trying to disable the stack protector for the -function which generates the stack canary value. - -The whole story started with Sergei reporting a boot crash with a kernel -built with gcc-10: - - Kernel panic — not syncing: stack-protector: Kernel stack is corrupted in: start_secondary - CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.6.0-rc5—00235—gfffb08b37df9 #139 - Hardware name: Gigabyte Technology Co., Ltd. To be filled by O.E.M./H77M—D3H, BIOS F12 11/14/2013 - Call Trace: - dump_stack - panic - ? start_secondary - __stack_chk_fail - start_secondary - secondary_startup_64 - -—-[ end Kernel panic — not syncing: stack—protector: Kernel stack is corrupted in: start_secondary - -This happens because gcc-10 tail-call optimizes the last function call -in start_secondary() - cpu_startup_entry() - and thus emits a stack -canary check which fails because the canary value changes after the -boot_init_stack_canary() call. - -To fix that, the initial attempt was to mark the one function which -generates the stack canary with: - - __attribute__((optimize("-fno-stack-protector"))) ... start_secondary(void *unused) - -however, using the optimize attribute doesn't work cumulatively -as the attribute does not add to but rather replaces previously -supplied optimization options - roughly all -fxxx options. - -The key one among them being -fno-omit-frame-pointer and thus leading to -not present frame pointer - frame pointer which the kernel needs. - -The next attempt to prevent compilers from tail-call optimizing -the last function call cpu_startup_entry(), shy of carving out -start_secondary() into a separate compilation unit and building it with --fno-stack-protector, is this one. - -The current solution is short and sweet, and reportedly, is supported by -both compilers so let's see how far we'll get this time. - -Reported-by: Sergei Trofimovich <sly...@gentoo.org> -Signed-off-by: Borislav Petkov <b...@suse.de> -Reviewed-by: Nick Desaulniers <ndesaulni...@google.com> -Reviewed-by: Kees Cook <keesc...@chromium.org> -Link: https://lkml.kernel.org/r/20200314164451.346497-1-sly...@gentoo.org ---- - arch/x86/include/asm/stackprotector.h | 7 ++++++- - arch/x86/kernel/smpboot.c | 8 ++++++++ - arch/x86/xen/smp_pv.c | 1 + - include/linux/compiler.h | 6 ++++++ - 4 files changed, 21 insertions(+), 1 deletion(-) - -diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h -index 91e29b6a86a5..9804a7957f4e 100644 ---- a/arch/x86/include/asm/stackprotector.h -+++ b/arch/x86/include/asm/stackprotector.h -@@ -55,8 +55,13 @@ - /* - * Initialize the stackprotector canary value. - * -- * NOTE: this must only be called from functions that never return, -+ * NOTE: this must only be called from functions that never return - * and it must always be inlined. -+ * -+ * In addition, it should be called from a compilation unit for which -+ * stack protector is disabled. Alternatively, the caller should not end -+ * with a function call which gets tail-call optimized as that would -+ * lead to checking a modified canary value. - */ - static __always_inline void boot_init_stack_canary(void) - { -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index 69881b2d446c..9674321ce3a3 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -262,6 +262,14 @@ static void notrace start_secondary(void *unused) - - wmb(); - cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); -+ -+ /* -+ * Prevent tail call to cpu_startup_entry() because the stack protector -+ * guard has been changed a couple of function calls up, in -+ * boot_init_stack_canary() and must not be checked before tail calling -+ * another function. -+ */ -+ prevent_tail_call_optimization(); - } - - /** -diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c -index 802ee5bba66c..0cebe5db691d 100644 ---- a/arch/x86/xen/smp_pv.c -+++ b/arch/x86/xen/smp_pv.c -@@ -92,6 +92,7 @@ asmlinkage __visible void cpu_bringup_and_idle(void) - cpu_bringup(); - boot_init_stack_canary(); - cpu_startup_entry(CPUHP_AP_ONLINE_IDLE); -+ prevent_tail_call_optimization(); - } - - void xen_smp_intr_free_pv(unsigned int cpu) -diff --git a/include/linux/compiler.h b/include/linux/compiler.h -index 034b0a644efc..732754d96039 100644 ---- a/include/linux/compiler.h -+++ b/include/linux/compiler.h -@@ -356,4 +356,10 @@ static inline void *offset_to_ptr(const int *off) - /* &a[0] degrades to a pointer: a different type from an array */ - #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) - -+/* -+ * This is needed in functions which generate the stack canary, see -+ * arch/x86/kernel/smpboot.c::start_secondary() for an example. -+ */ -+#define prevent_tail_call_optimization() asm("") -+ - #endif /* __LINUX_COMPILER_H */ --- -2.26.2 - Modified: PKGBUILD =================================================================== --- PKGBUILD 2020-05-20 22:56:10 UTC (rev 387041) +++ PKGBUILD 2020-05-20 22:56:30 UTC (rev 387042) @@ -1,7 +1,7 @@ # Maintainer: Andreas Radke <andy...@archlinux.org> pkgbase=linux-lts -pkgver=5.4.41 +pkgver=5.4.42 pkgrel=1 pkgdesc='LTS Linux' url="https://www.kernel.org/" @@ -16,10 +16,8 @@ source=( https://www.kernel.org/pub/linux/kernel/v${pkgver%%.*}.x/${_srcname}.tar.{xz,sign} config # the main kernel config file - 0001-add-sysctl-and-CONFIG-for-unprivileged_userns_clone.patch - 0001-gcc-common.h-Update-for-GCC-10.patch - 0002-Makefile-disallow-data-races-on-gcc-10-as-well.patch - 0003-x86-Fix-early-boot-crash-on-gcc-10-next-try.patch + 0001-ZEN-Add-sysctl-and-CONFIG-to-disallow-unprivileged-C.patch + 0002-gcc-common.h-Update-for-GCC-10.patch sphinx-workaround.patch ) validpgpkeys=( @@ -27,13 +25,11 @@ '647F28654894E3BD457199BE38DBBDC86092693E' # Greg Kroah-Hartman ) # https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc -sha256sums=('1e64e7c247d7440b0dd9fa63135cf7078c3e09b933ae66dfb3e07b05dcf8b057' +sha256sums=('4e431b7c0266a07b76fdb77f8917ad681f0fa34ffba0eb8a172b67f7ef57bc31' 'SKIP' '8b202067f6f0adbe2f8d4290624005f4fa1fff32aaa42f979c9ab03f6b74b62f' - 'a13581d3c6dc595206e4fe7fcf6b542e7a1bdbe96101f0f010fc5be49f99baf2' - '2b63997760aa823b5907c3c5653f35265e9c6320b812b4f4a8e7c74256dab7c7' - '875400c2dded3c05588025e0095b529c53f317abcccc99507eff0a75f24aa93f' - 'b7505c345722c4c1ca27c8d99114d4b8746e530acd9b7c4e5a0601b89bfba2d2' + 'bdd05caf94135898bceac0a9d14ec6b1b458dba162d00efd46a292fe97f2679b' + 'bdfd9d472790f1f417459c6c4f16f492140e772f0f3e502c5e915f581cf7d75a' 'b7c814c8183e4645947a6dcc3cbf80431de8a8fd4e895b780f9a5fd92f82cb8e') export KBUILD_BUILD_HOST=archlinux