From: Nix <nix@esperi.org.uk>
To: Florian Weimer <fweimer@redhat.com>
Cc: libc-alpha@sourceware.org
Subject: Re: [PATCH 09/12] Link various tests with -fno-stack-protector.
Date: Thu, 15 Dec 2016 15:55:00 -0000 [thread overview]
Message-ID: <874m25jif9.fsf@esperi.org.uk> (raw)
In-Reply-To: <87a8bxjl9n.fsf@esperi.org.uk> (nix@esperi.org.uk's message of "Thu, 15 Dec 2016 14:54:12 +0000")
On 15 Dec 2016, nix@esperi.org.uk spake thusly:
> On 15 Dec 2016, Florian Weimer uttered the following:
>
>> On 11/28/2016 01:32 PM, Nix wrote:
>>
>>> diff --git a/elf/Makefile b/elf/Makefile
>>> index daf0ebd..7588ca0 100644
>>> --- a/elf/Makefile
>>> +++ b/elf/Makefile
>>> @@ -775,6 +775,10 @@ $(objpfx)filtmod1.so: $(objpfx)filtmod1.os $(objpfx)filtmod2.so
>>> $< -Wl,-F,$(objpfx)filtmod2.so
>>> $(objpfx)filter: $(objpfx)filtmod1.so
>>>
>>> +# These do not link against libc.
>>> +CFLAGS-filtmod1.c = $(no-stack-protector)
>>> +CFLAGS-filtmod2.c = $(no-stack-protector)
>>
>> Is this really necessary for filtmod2.c?
>
> I assumed it was wisest to link it with the same options as the library
> it was the filter for. It might be harmless, though -- I'll drop it and
> find out!
It's harmless! Removed.
>>> diff --git a/stdlib/Makefile b/stdlib/Makefile
>>> index 3cce9d9..6d7586e 100644
>>> --- a/stdlib/Makefile
>>> +++ b/stdlib/Makefile
>>> @@ -187,6 +187,9 @@ LDFLAGS-tst-putenv = $(no-as-needed)
>>>
>>> $(objpfx)tst-putenvmod.so: $(objpfx)tst-putenvmod.os $(link-libc-deps)
>>> $(build-module)
>>> +# This is not only not in libc, it's not even linked with it.
>>> +CFLAGS-tst-putenvmod.c += $(no-stack-protector)
>>
>> I think this papers over an actual failure. Based on my build logs,
>> tst-putenvmod.so is properly linked against libc (including
>> libc_nonshared.a).
>
> Hmm! I'll take that out and have a look. Maybe __attribute
> ((constructor)) is causing problems, though I'd assume this would work
> fine or other stack-protector users would be howling.
>
> Much of this may be residual fallout from the days before we had the
> stack-protector symbol export from libc/internal refs inside libc
> working right.
Likewise harmless: removed. (At least, it works on x86_64. I'll do a
full test cycle before sending the next series, so it gets tested on
x86-32, sparc64/32, and ARM as well. It might be necessary on one of
those. :) )
>>> diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
>>> index 6d99284..fbe138f 100644
>>> --- a/sysdeps/x86_64/Makefile
>>> +++ b/sysdeps/x86_64/Makefile
>>> @@ -46,6 +46,9 @@ tests-pie += $(quad-pie-test)
>>> test-extras += tst-quadmod1pie tst-quadmod2pie
>>> extra-test-objs += tst-quadmod1pie.o tst-quadmod2pie.o
>>>
>>> +CFLAGS-tst-quad1pie.c = $(no-stack-protector)
>>> +CFLAGS-tst-quad2pie.c = $(no-stack-protector)
>>
>> This looks like a genuine test failure as well. I'll try to reproduce it, after I have tracked down the more catastrophic MIPS
>> build failure …
>
> Yeah: they link against libc as well. Maybe I was misled by an
> old-binutils problem back in the early days of this patch.
>
> I'll try pulling this out as well...
Nope nope nope:
gcc ../sysdeps/x86_64/tst-quad1pie.c -c -std=gnu11 -fgnu89-inline -O2 -Wall -Werror -Wundef -Wwrite-strings -fmerge-all-constants -frounding-math -fstack-protector-all -g -Wstrict-prototypes -Wold-style-definition -I../include -I/home/oranix/oracle/src/x86_64-spindle/elf -I/home/oranix/oracle/src/x86_64-spindle -I../sysdeps/unix/sysv/linux/x86_64/64 -I../sysdeps/unix/sysv/linux/x86_64 -I../sysdeps/unix/sysv/linux/x86 -I../sysdeps/unix/sysv/linux/wordsize-64 -I../sysdeps/x86_64/nptl -I../sysdeps/unix/sysv/linux/include -I../sysdeps/unix/sysv/linux -I../sysdeps/nptl -I../sysdeps/pthread -I../sysdeps/gnu -I../sysdeps/unix/inet -I../sysdeps/unix/sysv -I../sysdeps/unix/x86_64 -I../sysdeps/unix -I../sysdeps/posix -I../sysdeps/x86_64/64 -I../sysdeps/x86_64/fpu/multiarch -I../sysdeps/x86_64/fpu -I../sysdeps/x86/fpu/include -I../sysdeps/x86/fpu -I../sysdeps/x86_64/multiarch -I../sysdeps/x86_64 -I../sysdeps/x86 -I../sysdeps/ieee754/ldbl-96/include -I../sysdeps/ieee754/ldbl-96 -I../sysdeps/ieee754/dbl-64/wordsize-64 -I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/wordsize-64 -I../sysdeps/ieee754 -I../sysdeps/generic -I.. -I../libio -I. -D_LIBC_REENTRANT -include /home/oranix/oracle/src/x86_64-spindle/libc-modules.h -DMODULE_NAME=nonlib -include ../include/libc-symbols.h -o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie.o -MD -MP -MF /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie.o.dt -MT /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie.o
gcc ../sysdeps/x86_64/tst-quad2pie.c -c -std=gnu11 -fgnu89-inline -O2 -Wall -Werror -Wundef -Wwrite-strings -fmerge-all-constants -frounding-math -fstack-protector-all -g -Wstrict-prototypes -Wold-style-definition -I../include -I/home/oranix/oracle/src/x86_64-spindle/elf -I/home/oranix/oracle/src/x86_64-spindle -I../sysdeps/unix/sysv/linux/x86_64/64 -I../sysdeps/unix/sysv/linux/x86_64 -I../sysdeps/unix/sysv/linux/x86 -I../sysdeps/unix/sysv/linux/wordsize-64 -I../sysdeps/x86_64/nptl -I../sysdeps/unix/sysv/linux/include -I../sysdeps/unix/sysv/linux -I../sysdeps/nptl -I../sysdeps/pthread -I../sysdeps/gnu -I../sysdeps/unix/inet -I../sysdeps/unix/sysv -I../sysdeps/unix/x86_64 -I../sysdeps/unix -I../sysdeps/posix -I../sysdeps/x86_64/64 -I../sysdeps/x86_64/fpu/multiarch -I../sysdeps/x86_64/fpu -I../sysdeps/x86/fpu/include -I../sysdeps/x86/fpu -I../sysdeps/x86_64/multiarch -I../sysdeps/x86_64 -I../sysdeps/x86 -I../sysdeps/ieee754/ldbl-96/include -I../sysdeps/ieee754/ldbl-96 -I../sysdeps/ieee754/dbl-64/wordsize-64 -I../sysdeps/ieee754/dbl-64 -I../sysdeps/ieee754/flt-32 -I../sysdeps/wordsize-64 -I../sysdeps/ieee754 -I../sysdeps/generic -I.. -I../libio -I. -D_LIBC_REENTRANT -include /home/oranix/oracle/src/x86_64-spindle/libc-modules.h -DMODULE_NAME=nonlib -include ../include/libc-symbols.h -o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie.o -MD -MP -MF /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie.o.dt -MT /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie.o
gcc -pie -Wl,-O1 -nostdlib -nostartfiles -o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie -Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both /home/oranix/oracle/src/x86_64-spindle/csu/Scrt1.o /home/oranix/oracle/src/x86_64-spindle/csu/crti.o `gcc --print-file-name=crtbeginS.o` /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie.o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quadmod1pie.o -Wl,-dynamic-linker=/lib64/ld-linux-x86-64.so.2 -Wl,-rpath-link=/home/oranix/oracle/src/x86_64-spindle:/home/oranix/oracle/src/x86_64-spindle/math:/home/oranix/oracle/src/x86_64-spindle/elf:/home/oranix/oracle/src/x86_64-spindle/dlfcn:/home/oranix/oracle/src/x86_64-spindle/nss:/home/oranix/oracle/src/x86_64-spindle/nis:/home/oranix/oracle/src/x86_64-spindle/rt:/home/oranix/oracle/src/x86_64-spindle/resolv:/home/oranix/oracle/src/x86_64-spindle/crypt:/home/oranix/oracle/src/x86_64-spindle/mathvec:/home/oranix/oracle/src/x86_64-spindle/nptl /home/oranix/oracle/src/x86_64-spindle/libc.so.6 /home/oranix/oracle/src/x86_64-spindle/libc_nonshared.a -Wl,--as-needed /home/oranix/oracle/src/x86_64-spindle/elf/ld.so -Wl,--no-as-needed -lgcc -Wl,--as-needed -lgcc_s -Wl,--no-as-needed `gcc --print-file-name=crtendS.o` /home/oranix/oracle/src/x86_64-spindle/csu/crtn.o
/usr/bin/ld: /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad1pie.o: relocation R_X86_64_PC32 against symbol `__stack_chk_fail@@GLIBC_2.4' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Bad value
gcc -pie -Wl,-O1 -nostdlib -nostartfiles -o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie -Wl,-z,combreloc -Wl,-z,relro -Wl,--hash-style=both /home/oranix/oracle/src/x86_64-spindle/csu/Scrt1.o /home/oranix/oracle/src/x86_64-spindle/csu/crti.o `gcc --print-file-name=crtbeginS.o` /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie.o /home/oranix/oracle/src/x86_64-spindle/elf/tst-quadmod2pie.o -Wl,-dynamic-linker=/lib64/ld-linux-x86-64.so.2 -Wl,-rpath-link=/home/oranix/oracle/src/x86_64-spindle:/home/oranix/oracle/src/x86_64-spindle/math:/home/oranix/oracle/src/x86_64-spindle/elf:/home/oranix/oracle/src/x86_64-spindle/dlfcn:/home/oranix/oracle/src/x86_64-spindle/nss:/home/oranix/oracle/src/x86_64-spindle/nis:/home/oranix/oracle/src/x86_64-spindle/rt:/home/oranix/oracle/src/x86_64-spindle/resolv:/home/oranix/oracle/src/x86_64-spindle/crypt:/home/oranix/oracle/src/x86_64-spindle/mathvec:/home/oranix/oracle/src/x86_64-spindle/nptl /home/oranix/oracle/src/x86_64-spindle/libc.so.6 /home/oranix/oracle/src/x86_64-spindle/libc_nonshared.a -Wl,--as-needed /home/oranix/oracle/src/x86_64-spindle/elf/ld.so -Wl,--no-as-needed -lgcc -Wl,--as-needed -lgcc_s -Wl,--no-as-needed `gcc --print-file-name=crtendS.o` /home/oranix/oracle/src/x86_64-spindle/csu/crtn.o
/usr/bin/ld: /home/oranix/oracle/src/x86_64-spindle/elf/tst-quad2pie.o: relocation R_X86_64_PC32 against symbol `__stack_chk_fail@@GLIBC_2.4' can not be used when making a shared object; recompile with -fPIC
/usr/bin/ld: final link failed: Bad value
I note that the quad 'pie' tests are not actually being build with -fpie
or anything like it, so it's no surprise that GCC is generating non-PIE
relocations. That's probably the underlying bug here. This seems to fix
it, and mirrors what is being done for elf/vismain.c. (Will roll it in
if you agree, or post it separately, 'cos it's really an unrelated bug.)
Fix to all the above, as delta against previous patch:
diff --git a/elf/Makefile b/elf/Makefile
index 7588ca0..2c87a94 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -775,9 +775,8 @@ $(objpfx)filtmod1.so: $(objpfx)filtmod1.os $(objpfx)filtmod2.so
$< -Wl,-F,$(objpfx)filtmod2.so
$(objpfx)filter: $(objpfx)filtmod1.so
-# These do not link against libc.
+# This does not link against libc.
CFLAGS-filtmod1.c = $(no-stack-protector)
-CFLAGS-filtmod2.c = $(no-stack-protector)
$(objpfx)unload: $(libdl)
$(objpfx)unload.out: $(objpfx)unloadmod.so
diff --git a/stdlib/Makefile b/stdlib/Makefile
index 6d7586e..cae2e8d 100644
--- a/stdlib/Makefile
+++ b/stdlib/Makefile
@@ -187,8 +187,6 @@ LDFLAGS-tst-putenv = $(no-as-needed)
$(objpfx)tst-putenvmod.so: $(objpfx)tst-putenvmod.os $(link-libc-deps)
$(build-module)
-# This is not only not in libc, it's not even linked with it.
-CFLAGS-tst-putenvmod.c += $(no-stack-protector)
libof-tst-putenvmod = extramodules
diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
index fbe138f..5f25893 100644
--- a/sysdeps/x86_64/Makefile
+++ b/sysdeps/x86_64/Makefile
@@ -46,12 +46,12 @@ tests-pie += $(quad-pie-test)
test-extras += tst-quadmod1pie tst-quadmod2pie
extra-test-objs += tst-quadmod1pie.o tst-quadmod2pie.o
-CFLAGS-tst-quad1pie.c = $(no-stack-protector)
-CFLAGS-tst-quad2pie.c = $(no-stack-protector)
-
$(objpfx)tst-quad1pie: $(objpfx)tst-quadmod1pie.o
$(objpfx)tst-quad2pie: $(objpfx)tst-quadmod2pie.o
+CFLAGS-tst-quad1pie.c = $(PIE-ccflag)
+CFLAGS-tst-quad2pie.c = $(PIE-ccflag)
+
tests += tst-audit3 tst-audit4 tst-audit5 tst-audit6 tst-audit7 tst-audit10
test-extras += tst-audit4-aux tst-audit10-aux
extra-test-objs += tst-audit4-aux.o tst-audit10-aux.o
next prev parent reply other threads:[~2016-12-15 15:55 UTC|newest]
Thread overview: 40+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-28 12:33 --enable-stack-protector for glibc, v9 Nix
2016-11-28 12:33 ` [PATCH 12/12] Enable -fstack-protector=* when requested by configure Nix
2016-11-28 12:33 ` [PATCH 03/12] Mark all machinery needed in early static-link init as -fno-stack-protector Nix
2016-12-15 14:01 ` Florian Weimer
2016-12-15 14:21 ` Nick Alcock
2016-12-15 14:31 ` Florian Weimer
2016-12-15 14:44 ` Nick Alcock
2016-11-28 12:33 ` [PATCH 06/12] Work even with compilers hacked to enable -fstack-protector by default Nix
2016-11-28 12:33 ` [PATCH 04/12] Compile the entire dynamic linker with -fno-stack-protector Nix
2016-11-28 12:33 ` [PATCH 07/12] Add stack_chk_fail_local to libc.so Nix
2016-11-28 13:25 ` [PATCH 09/12] Link various tests with -fno-stack-protector Nix
2016-12-15 14:43 ` Florian Weimer
2016-12-15 14:54 ` Nix
2016-12-15 15:54 ` Florian Weimer
2016-12-15 15:56 ` Nix
2016-12-15 15:55 ` Nix [this message]
2016-11-28 13:25 ` [PATCH 08/12] De-PLTize __stack_chk_fail internal calls within libc.so Nix
2016-12-15 13:56 ` Florian Weimer
2016-12-15 14:16 ` Nix
2016-12-15 14:21 ` Florian Weimer
2016-12-15 14:29 ` Nix
2016-12-15 14:33 ` Florian Weimer
2016-12-15 14:40 ` Nix
2016-12-15 17:24 ` Nix
2016-12-15 18:22 ` Florian Weimer
2016-12-15 20:00 ` Nix
2016-12-15 20:22 ` Florian Weimer
2016-12-15 20:44 ` Florian Weimer
2016-12-15 20:49 ` Nix
2016-12-15 20:58 ` Florian Weimer
2016-12-16 11:39 ` Florian Weimer
2016-12-16 11:44 ` Nix
2016-11-28 13:25 ` [PATCH 10/12] Drop explicit stack-protection of pieces of the system Nix
2016-11-28 13:26 ` [PATCH 11/12] Do not stack-protect sigreturn stubs Nix
2016-11-28 13:26 ` [PATCH 02/12] Do not stack-protect ifunc resolvers Nix
2016-12-15 12:18 ` Florian Weimer
2016-12-15 12:34 ` Nick Alcock
2016-12-15 12:58 ` Florian Weimer
2016-11-28 13:26 ` [PATCH 05/12] Prevent the rtld mapfile computation from dragging in __stack_chk_fail* Nix
2016-11-28 13:26 ` [PATCH 01/12] Initialize the stack guard earlier when linking statically Nix
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=874m25jif9.fsf@esperi.org.uk \
--to=nix@esperi.org.uk \
--cc=fweimer@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).