Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S964998AbcJRPsU (ORCPT ); Tue, 18 Oct 2016 11:48:20 -0400 Received: from mail-it0-f65.google.com ([209.85.214.65]:33701 "EHLO mail-it0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S964865AbcJRPsT (ORCPT ); Tue, 18 Oct 2016 11:48:19 -0400 MIME-Version: 1.0 In-Reply-To: <20161018153755.GA10386@kroah.com> References: <20161018153755.GA10386@kroah.com> From: Shuah Khan Date: Tue, 18 Oct 2016 09:48:17 -0600 Message-ID: Subject: Re: Ubuntu 16.10 - Linux Kernel build fails - GCC related To: Greg KH Cc: Linus Torvalds , mmarek@suse.com, LKML Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 5257 Lines: 133 On Tue, Oct 18, 2016 at 9:37 AM, Greg KH wrote: > On Tue, Oct 18, 2016 at 09:24:20AM -0600, Shuah Khan wrote: >> After upgrading to Ubuntu 16.10, I can't build kernels anymore unless >> the following patch is applied to the kernel Makefile. A word of >> caution for anybody that is planning to update their development >> systems. >> >> https://patchwork.ozlabs.org/patch/616621/ >> >> Please refer to the Ubuntu 16.10 release notes for more details. >> >> https://wiki.ubuntu.com/YakketyYak/ReleaseNotes#GCC >> >> Ubuntu is recommended applying this patch for building Linux kernels. >> I am not sure this is the right way to go. I am hoping this is >> work-around and patching the kernel Makefile will not be the solution >> going forward. >> >> I haven't seen any patch sent upstream to make this change, so I still >> hope this is a temporary work-around. Maybe be there is patch that >> came through and you are aware of this problem? > > Does commit 6d92bc9d483a solve this issue for you? That should have > resolved a -pie issue, back in 4.6, or is this something else? > This is a new problem because of a change Ubuntu made in their gcc version 6.2.0 20161005 (Ubuntu 6.2.0-5ubuntu12) it appears. The Ubuntu 16.10 release notes says: "We have modified GCC to by-default compile programs with position independent executable support to improve the security benefits provided by Address Space Layout Randomization. This may cause difficulty when trying to compile Linux kernels that still need this patch applied. Other programs may experience other problems; some debugging guidelines are at https://wiki.ubuntu.com/SecurityTeam/PIE" The above clearly states a patch needs to applied to the Linux Kernel makefile. This patch forces no-pie for distro compilers that enable pie by default The error I am seeing on 4.9-rc1 is: CHK include/config/kernel.release Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: -fstack-protector-strong not supported by compiler Makefile:1058: recipe for target 'prepare-compiler-check' failed make: *** [prepare-compiler-check] Error 1 I think CONFIG_CC_STACKPROTECTOR_STRONG is enabled in most distro configs. So I am not why this should fail now. Here is the Ubuntu recommended patch for easy reference: (note cut and paste - probably won't apply) - https://patchwork.ozlabs.org/patch/616621/ diff --git a/Makefile b/Makefile index e27da43..e4e8331 100644 --- a/Makefile +++ b/Makefile @@ -640,6 +640,11 @@ ifneq ($(CONFIG_FRAME_WARN),0) KBUILD_CFLAGS += $(call cc-option,-Wframe-larger-than=${CONFIG_FRAME_WARN}) endif +# force no-pie for distro compilers that enable pie by default +KBUILD_CFLAGS += $(call cc-option, -fno-pie) +KBUILD_CFLAGS += $(call cc-option, -no-pie) +KBUILD_AFLAGS += $(call cc-option, -fno-pie) + # Handle stack protector mode. # # Since kbuild can potentially perform two passes (first with the old diff --git a/arch/x86/Makefile b/arch/x86/Makefile index 4086abc..84d1cc8 100644 --- a/arch/x86/Makefile +++ b/arch/x86/Makefile @@ -27,6 +27,7 @@ REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -D__KERNEL__ \ -mno-mmx -mno-sse \ $(call cc-option, -ffreestanding) \ $(call cc-option, -fno-stack-protector) \ + $(call cc-option, -fno-pie) \ $(call cc-option, -mpreferred-stack-boundary=2) export REALMODE_CFLAGS @@ -129,7 +130,7 @@ endif # Make sure compiler does not have buggy stack-protector support. ifdef CONFIG_CC_STACKPROTECTOR cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh - ifneq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(KBUILD_CPPFLAGS) $(biarch)),y) + ifneq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) -fno-pie $(KBUILD_CPPFLAGS) $(biarch)),y) $(warning stack-protector enabled but compiler support broken) endif endif diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile index 265c0ed..9677975 100644 --- a/arch/x86/entry/vdso/Makefile +++ b/arch/x86/entry/vdso/Makefile @@ -44,6 +44,7 @@ export CPPFLAGS_vdso.lds += -P -C VDSO_LDFLAGS_vdso.lds = -m64 -Wl,-soname=linux-vdso.so.1 \ -Wl,--no-undefined \ -Wl,-z,max-page-size=4096 -Wl,-z,common-page-size=4096 \ + $(call ld-option, -no-pie) \ $(DISABLE_LTO) $(obj)/vdso64.so.dbg: $(src)/vdso.lds $(vobjs) FORCE @@ -67,6 +68,7 @@ $(obj)/vdso-image-%.c: $(obj)/vdso%.so.dbg $(obj)/vdso%.so $(obj)/vdso2c FORCE CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \ $(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector) \ -fno-omit-frame-pointer -foptimize-sibling-calls \ + $(call cc-option, -fno-pie) \ -DDISABLE_BRANCH_PROFILING -DBUILD_VDSO $(vobjs): KBUILD_CFLAGS += $(CFL) @@ -140,6 +142,7 @@ KBUILD_CFLAGS_32 := $(filter-out -mcmodel=kernel,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out -fno-pic,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 := $(filter-out -mfentry,$(KBUILD_CFLAGS_32)) KBUILD_CFLAGS_32 += -m32 -msoft-float -mregparm=0 -fpic +KBUILD_CFLAGS_32 += $(call cc-option, -no-pie) KBUILD_CFLAGS_32 += $(call cc-option, -fno-stack-protector) KBUILD_CFLAGS_32 += $(call cc-option, -foptimize-sibling-calls) KBUILD_CFLAGS_32 += -fno-omit-frame-pointer thanks, -- Shuah