start_kernel: Add __no_stack_protector function attribute

nickdesaulniers · gregkh · commit 25e73018b409 · 2023-07-19T16:35:05.000+02:00
commit 514ca14 upstream. Back during the discussion of commit a9a3ed1 ("x86: Fix early boot crash on gcc-10, third try") we discussed the need for a function attribute to control the omission of stack protectors on a per-function basis; at the time Clang had support for no_stack_protector but GCC did not. This was fixed in gcc-11. Now that the function attribute is available, let's start using it. Callers of boot_init_stack_canary need to use this function attribute unless they're compiled with -fno-stack-protector, otherwise the canary stored in the stack slot of the caller will differ upon the call to boot_init_stack_canary. This will lead to a call to __stack_chk_fail() then panic. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94722 Link: https://lore.kernel.org/all/20200316130414.GC12561@hirez.programming.kicks-ass.net/ Tested-by: Nathan Chancellor <nathan@kernel.org> Acked-by: Michael Ellerman <mpe@ellerman.id.au> (powerpc) Acked-by: Miguel Ojeda <ojeda@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com> Link: https://lore.kernel.org/r/20230412-no_stackp-v2-1-116f9fe4bbe7@google.com Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: ndesaulniers@google.com <ndesaulniers@google.com>
diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c
@@ -1605,6 +1605,7 @@ static void add_cpu_to_masks(int cpu)
 }
 
 /* Activate a secondary processor. */
+__no_stack_protector
 void start_secondary(void *unused)
 {
 	unsigned int cpu = raw_smp_processor_id();
diff --git a/include/linux/compiler_attributes.h b/include/linux/compiler_attributes.h
@@ -255,6 +255,18 @@
  */
 #define __noreturn                      __attribute__((__noreturn__))
 
+/*
+ * Optional: only supported since GCC >= 11.1, clang >= 7.0.
+ *
+ *   gcc: https://gcc.gnu.org/onlinedocs/gcc/Common-Function-Attributes.html#index-no_005fstack_005fprotector-function-attribute
+ *   clang: https://clang.llvm.org/docs/AttributeReference.html#no-stack-protector-safebuffers
+ */
+#if __has_attribute(__no_stack_protector__)
+# define __no_stack_protector		__attribute__((__no_stack_protector__))
+#else
+# define __no_stack_protector
+#endif
+
 /*
  * Optional: not supported by gcc.
  *
diff --git a/init/main.c b/init/main.c
@@ -877,7 +877,8 @@ static void __init print_unknown_bootoptions(void)
 	memblock_free(unknown_options, len);
 }
 
-asmlinkage __visible void __init __no_sanitize_address __noreturn start_kernel(void)
+asmlinkage __visible __init __no_sanitize_address __noreturn __no_stack_protector
+void start_kernel(void)
 {
 	char *command_line;
 	char *after_dashes;

Original file line number	Diff line number	Diff line change
`@@ -1605,6 +1605,7 @@ static void add_cpu_to_masks(int cpu)`
`1605`	`1605`	`}`
`1606`	`1606`
`1607`	`1607`	`/* Activate a secondary processor. */`
	`1608`	`+__no_stack_protector`
`1608`	`1609`	`void start_secondary(void *unused)`
`1609`	`1610`	`{`
`1610`	`1611`	`unsigned int cpu = raw_smp_processor_id();`
Original file line number	Diff line number	Diff line change
`@@ -877,7 +877,8 @@ static void __init print_unknown_bootoptions(void)`
`877`	`877`	`memblock_free(unknown_options, len);`
`878`	`878`	`}`
`879`	`879`
`880`		`-asmlinkage __visible void __init __no_sanitize_address __noreturn start_kernel(void)`
	`880`	`+asmlinkage __visible __init __no_sanitize_address __noreturn __no_stack_protector`
	`881`	`+void start_kernel(void)`
`881`	`882`	`{`
`882`	`883`	`char *command_line;`
`883`	`884`	`char *after_dashes;`