Messages in this thread Patch in this message | | | From | Kees Cook <> | Date | Fri, 17 Nov 2017 21:14:41 -0800 | Subject | Re: [nfsd4] potentially hardware breaking regression in 4.14-rc and 4.13.11 |
| |
On Fri, Nov 17, 2017 at 5:54 PM, Patrick McLean <chutzpah@gentoo.org> wrote: > On 2017-11-17 04:55 PM, Linus Torvalds wrote: >> On Fri, Nov 17, 2017 at 4:27 PM, Patrick McLean <chutzpah@gentoo.org> wrote: >>> >>> I am still getting the crash at d9e12200852d, I figured I would >>> double-check the "good" and "bad" kernels before starting a full bisect. >> >> .. but without GCC_PLUGIN_RANDSTRUCT it's solid? > > Yes, without GCC_PLUGIN_RANDSTRUCT it's solid.
That's strange. With d9e12200852d the shuffle_seed variables won't ever actually get used. (i.e. I wouldn't expect the seed to change any behavior.)
Can you confirm with something like this:
diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c index cdaac8c66734..aac570a57d7d 100644 --- a/scripts/gcc-plugins/randomize_layout_plugin.c +++ b/scripts/gcc-plugins/randomize_layout_plugin.c @@ -267,12 +267,10 @@ static void shuffle(const_tree type, tree *newtree, unsigned long length)
structname = ORIG_TYPE_NAME(type);
-#ifdef __DEBUG_PLUGIN fprintf(stderr, "Shuffling struct %s %p\n", (const char *)structname, type); #ifdef __DEBUG_VERBOSE debug_tree((tree)type); #endif -#endif
for (i = 0; i < 4; i++) { seed[i] = shuffle_seed[i];
You should see no reports of "Shuffling struct ..."
And if it reports nothing, and you're on d9e12200852d, can you confirm that switching to a "good" seed fixes it? (If it _does_, then I suspect a build artifact being left behind or something odd like that.)
>> Kees removed even the baseline "randomize pure function pointer >> structures", so at that commit, nothing should be randomized. >> >> But maybe the plugin code itself ends up confusing gcc somehow? >> >> Even when it doesn't actually do that "relayout_struct()" on the >> structure, it always does those TYPE_ATTRIBUTES() games.
FWIW, myself doing a build at d9e12200852d with and without GCC_PLUGIN_RANDSTRUCT _appears_ to produce identical objdump output where I did spot-checks.
Also, do you have any other plugins enabled? (Can you send your .config?)
-Kees
-- Kees Cook Pixel Security
| |