Bug 204333 - arch/x86/boot/compressed/kaslr_64.c embeds build paths in kernel binary
Summary: arch/x86/boot/compressed/kaslr_64.c embeds build paths in kernel binary
Status: RESOLVED CODE_FIX
Alias: None
Product: Platform Specific/Hardware
Classification: Unclassified
Component: x86-64 (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: platform_x86_64@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-07-26 18:04 UTC by Ross Burton
Modified: 2022-01-06 23:29 UTC (History)
1 user (show)

See Also:
Kernel Version: 5.0.19
Subsystem:
Regression: No
Bisected commit-id:


Attachments

Description Ross Burton 2019-07-26 18:04:12 UTC
A built kernel can contain build paths:

$ strings bzImage-5.0.19-yocto-standard |grep tmp/
out of pgt_buf in /data/poky-tmp/reproducible/tmp/work-shared/qemux86-64/kernel-source/arch/x86/boot/compressed/kaslr_64.c!?

Easy enough to find that in the kernel:

$ git grep 'out of pgt_buf'
arch/x86/boot/compressed/kaslr_64.c:            debug_putstr("out of pgt_buf in " __FILE__ "!?\n");

But what's this in the top-level Makefile:

$ git grep prefix-map
Makefile:KBUILD_CFLAGS  += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)

So the __FILE__ shouldn't be using the full path.  However arch/x86/boot/compressed/Makefile has this:

KBUILD_CFLAGS := -m$(BITS) -O2

So that clears KBUILD_FLAGS, removing the -fmacro-prefix-map option.

I've now hit the edge of my knowledge.  Is the build in arch/x86/boot/compressed sufficiently special that it *should* start from a clean KBUILD_CFLAGS, so it needs this added:

+KBUILD_CFLAGS += $(call cc-option,-fmacro-prefix-map=$(srctree)/=)

Or, should it *not* clear the KBUILD_CFLAGS and instead just extend or prune.  Of not is that none of the other architectures reset KBUILD_CFLAGS but prune it first, so I'm guessing that is what the x86 Makefile should do too.
Comment 1 Borislav Petkov 2019-09-26 08:37:09 UTC
Both arch/x86/boot/compressed/Makefile and arch/x86/boot/Makefile start from clean KBUILD_CFLAGS so I think you should simply add the -fmacro-prefix-map line to both of them. Care to send a fix?

Thx.
Comment 2 Ross Burton 2019-09-26 09:13:32 UTC
Patch posted.
Comment 3 Borislav Petkov 2022-01-06 23:29:44 UTC
Upstream commit:

9e2276fa6eb3 ("arch/x86/boot: Use prefix map to avoid embedded paths")

Closing.

Note You need to log in before you can comment on or make changes to this bug.