Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v3] x86/vmlinux: Fix vmlinux.lds.S with pre-2.23 binutils
To:     Kees Cook <keescook@chromium.org>,
        Arvind Sankar <nivedita@alum.mit.edu>
Cc:     Thomas Gleixner <tglx@linutronix.de>,
        Ingo Molnar <mingo@redhat.com>, Borislav Petkov <bp@alien8.de>,
        x86@kernel.org, linux-kernel@vger.kernel.org,
        Thomas Lendacky <Thomas.Lendacky@amd.com>,
        Mauro Rossi <issor.oruam@gmail.com>,
        Michael Matz <matz@suse.de>
References: <20200113161310.GA191743@rani.riverdale.lan>
 <20200113195337.604646-1-nivedita@alum.mit.edu>
 <202001131750.C1B8468@keescook>
From:   "H. Peter Anvin" <hpa@zytor.com>
Message-ID: <261ae869-4169-296e-f673-5c08ff34bdde@zytor.com>
Date:   Mon, 13 Jan 2020 17:57:23 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
 Thunderbird/68.3.1
MIME-Version: 1.0
In-Reply-To: <202001131750.C1B8468@keescook>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 2020-01-13 17:53, Kees Cook wrote:>>
>> diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
>> index 3a1a819da137..bad4e22384dc 100644
>> --- a/arch/x86/kernel/vmlinux.lds.S
>> +++ b/arch/x86/kernel/vmlinux.lds.S
>> @@ -144,10 +144,12 @@ SECTIONS
>>  		*(.text.__x86.indirect_thunk)
>>  		__indirect_thunk_end = .;
>>  #endif
>> +
>> +		/* End of text section */
>> +		_etext = .;
>>  	} :text =0xcccc
>>  
>> -	/* End of text section, which should occupy whole number of pages */
>> -	_etext = .;
>> +	/* .text should occupy whole number of pages */
>>  	. = ALIGN(PAGE_SIZE);
> 
> NAK: linkers can add things at the end of .text that will go missing from
> the kernel if _etext isn't _outside_ the .text section, truly beyond the
> end of the .text section. This patch will break Control Flow Integrity
> checking since the jump tables are at the end of .text.
> 
> Boris, we're always working around weird linker problems; I don't see a
> problem with the v2 patch to fix up old binutils...
> 

Why not add the marker into a separate section instead of leaving it as an
absolute "floater"? Very old binutils would botch that case, but I think that
has been long since addressed well below our current minimum version.

	-hpa