kernel build at hardened fails in vdso_standalone_test_x86

[toralf]

me wonders about this at a stable hardened server:

Code: Select all

randconfig failed for v3.19-rc5 :...
  HOSTCC  Documentation/prctl/disable-tsc-on-off-stress-test
  HOSTCC  Documentation/prctl/disable-tsc-test
  HOSTCC  Documentation/ptp/testptp
  HOSTCC  Documentation/spi/spidev_test
  HOSTCC  Documentation/spi/spidev_fdx
  HOSTCC  Documentation/timers/hpet_example
  HOSTCC  Documentation/vDSO/vdso_standalone_test_x86.o
  HOSTCC  Documentation/vDSO/parse_vdso.o
  HOSTLD  Documentation/vDSO/vdso_standalone_test_x86
/usr/lib/gcc/x86_64-pc-linux-gnu/4.8.3/../../../../x86_64-pc-linux-gnu/bin/ld: Documentation/vDSO/parse_vdso.o: undefined reference to symbol '__stack_chk_fail@@GLIBC_2.4'
/lib64/libc.so.6: error adding symbols: DSO missing from command line
collect2: error: ld returned 1 exit status
scripts/Makefile.host:100: recipe for target 'Documentation/vDSO/vdso_standalone_test_x86' failed
make[2]: *** [Documentation/vDSO/vdso_standalone_test_x86] Error 1
scripts/Makefile.build:402: recipe for target 'Documentation/vDSO' failed
make[1]: *** [Documentation/vDSO] Error 2
Makefile:917: recipe for target 'vmlinux' failed
make: *** [vmlinux] Error 2

#

Any hints ?

[kernelOfTruth]

perhaps you switched between gcc versions and you're using a different one than the one you used to build glibc ?

that's all that comes to mind at the moment

hope that helps ...

*good luck* !

[toralf]

well, no, there's just one gcc at that system since a loong time :

Code: Select all

tor-relay /usr/src/linux # gcc-config -l
 [1] x86_64-pc-linux-gnu-4.8.3 *
 [2] x86_64-pc-linux-gnu-4.8.3-hardenednopie
 [3] x86_64-pc-linux-gnu-4.8.3-hardenednopiessp
 [4] x86_64-pc-linux-gnu-4.8.3-hardenednossp
 [5] x86_64-pc-linux-gnu-4.8.3-vanilla

tor-relay /usr/src/linux # qlop --gauge --human gcc
Fri Oct 24 23:04:35 2014 >>> sys-devel/gcc-4.7.3-r1
Sat Oct 25 01:55:30 2014 >>> sys-devel/gcc-4.8.3
Sat Oct 25 02:03:03 2014 >>> sys-devel/gcc-config-1.7.3
Sat Oct 25 10:28:55 2014 >>> sys-devel/gcc-config-1.7.3
Sat Oct 25 12:53:47 2014 >>> sys-devel/gcc-4.8.3
Sat Oct 25 14:23:51 2014 >>> sys-devel/gcc-4.7.3-r1
gcc: Fri Oct 24 22:33:34 2014: 31 minutes, 1 second
gcc: Sat Oct 25 01:22:36 2014: 32 minutes, 54 seconds
gcc: Sat Oct 25 03:28:33 2014: 9 hours, 25 minutes, 14 seconds
gcc: Sat Oct 25 13:47:29 2014: 36 minutes, 22 seconds
gcc: 4 times

[Hu]

What is the command line used for building the failed DSO?

[toralf]

A .config example is here : http://article.gmane.org/gmane.linux.kernel/1868542

And this is the script I'm using

Code: Select all

tor-relay /mnt/qa/kernel # cat kernel_qa_test.sh 
#!/bin/bash

#  Toralf Förster
#  Hamburg
#  Germany


mailto=tor-relay@zwiebeltoralf.de

export KCONFIG_ALLCONFIG=~/kernel_qa_test.cfg
cd ~/linux

d1=0
while [[ true ]]
do
  d2=$(date +%s)
  diff=$(echo $d2 - $d1 | bc)
  if [[ $diff -gt 86400 ]]; then
    git pull 1>make.log 2>&1 && d1=$d2
  fi

  make mrproper                 1>make.log 2>&1
  make randconfig               1>make.log 2>&1
  yes "" | make silentoldconfig 1>make.log 2>&1

  make                          1>make.log 2>&1
  if [[ $? -ne 0 ]]; then
    (
      echo "randconfig failed for $(git describe) :"
      echo -e "\n..."
      grep -B 15 'Error 2' make.log || tail -n 15 make.log
      echo
      cat .config
    ) | mail -s "randconfig issue" $mailto
    d1=0        #       force a sync
  fi
done

cat make.log | mail -s "randconfig finished with rc=$?" $mailto
exit

with this .config defaults

Code: Select all

tor-relay /mnt/qa/kernel # cat kernel_qa_test.cfg 
#  default kernel config options
#

#
#
CONFIG_ENABLE_WARN_DEPRECATED=n

#  obsolete
#
CONFIG_ISDN=n
CONFIG_SOUND_OSS=n
CONFIG_SOUND_OSS_CORE=n
CONFIG_PRIME=n
CONFIG_X86_NUMAQ=n
CONFIG_IDE=n

#  external file required otherwise
#
CONFIG_STANDALONE=y
CONFIG_FW_LOADER=n
CONFIG_PREVENT_FIRMWARE_BUILD=y
#  never ever
#
CONFIG_FIRMWARE_IN_KERNEL=n

#  buggy per definition
#
CONFIG_STAGING=n

#  bloat up compile time and size
#
CONFIG_DEBUG_INFO=n

#  too much driver mess
#
CONFIG_MEDIA_SUPPORT=n

[mv]

Maybe it is a red herring, but the error is the same as in [bug=528742]this bug[/bug].
It seems that something related to the hardening patches to gcc (which apply also to non-hardened gcc) is broken.
In the lack of understanding how it should work, I am unfortunately not able to understand what does not work, here...

[Hu]

I meant, what is the specific command that make runs to build that DSO, not what command you use to run make. Although, since you shared the script, I have a few suggestions for improvements.

Code: Select all

while [[ true ]]

This can be written as while :; or while true;. Using brackets without an operator is equivalent to test -n true, which is true when the string true is not empty.

Code: Select all

  if [[ $diff -gt 86400 ]]; then
    git pull 1>make.log 2>&1 && d1=$d2
  fi
  make mrproper                 1>make.log 2>&1
  make randconfig               1>make.log 2>&1
  yes "" | make silentoldconfig 1>make.log 2>&1
  make                          1>make.log 2>&1
  if [[ $? -ne 0 ]]; then

This tests only whether the final make succeeds, but ignores any errors returned from earlier steps. Kernel makes generally should not fail the earlier steps, but if one did, subsequent commands might fail in unexpected ways. This also leads to another problem: each of these commands truncates make.log on startup, so the only way to get the output of any commands other than the bare make is if a signal kills the whole script. You could rewrite this as:

Code: Select all

{ 
  if [[ $diff -gt 86400 ]]; then
    git pull && d1=$d2
  fi
  make mrproper &&
  make randconfig &&
  yes "" | make silentoldconfig &&
  make
} 1>make.log 2>&1

This would bail out early if any step other than the git pull fails. By redirecting the output of the braced expression, make.log is only truncated once, at the beginning, so output from each make will be included.

Code: Select all

cat make.log | mail -s "randconfig finished with rc=$?" $mailto

Useless Use Of Cat. You can redirect stdin for mail instead.

[toralf]

Thx (well, in the origin script I do have a date instead of cat, and usually I do have "&&\" in the make - sequence, but yes, there's room for improvement)

And special thx for this

Code:
while [[ true ]]
This can be written as while :; or while true;. Using brackets without an operator is equivalent to test -n true, which is true when the string true is not empty.

[kernelOfTruth]

Any news for this ?


The offending config option seems to be

Code: Select all

CONFIG_BUILD_DOCSRC=y

and it should work fine on x86_64 but it also doesn't here (I never had this option enabled and per chance had it enabled today for several kernel builds)

so disabling should help

[frankenputer]

Same snafu

Code: Select all

  LD      Documentation/video4linux/built-in.o
  HOSTCC  Documentation/watchdog/src/watchdog-simple
  HOSTLD  Documentation/vDSO/vdso_standalone_test_x86
collect2: error: ld returned 1 exit status
scripts/Makefile.host:134: recipe for target 'Documentation/vDSO/vdso_standalone_test_x86' failed
make[2]: *** [Documentation/vDSO/vdso_standalone_test_x86] Error 1
scripts/Makefile.build:403: recipe for target 'Documentation/vDSO' failed
make[1]: *** [Documentation/vDSO] Error 2
make[1]: *** Waiting for unfinished jobs....
  HOSTCC  Documentation/watchdog/src/watchdog-test
Makefile:922: recipe for target 'vmlinux' failed
make: *** [vmlinux] Error 2
  INSTALL Documentation/connector/cn_test.ko
  INSTALL drivers/acpi/button.ko
  INSTALL drivers/block/sx8.ko
cp: cannot stat ‘Documentation/connector/cn_test.ko’: No such file or directory
cp: cannot stat ‘drivers/acpi/button.ko’: No such file or directory
At main.c:255:
- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175
- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178
sign-file: cp: cannot stat ‘drivers/block/sx8.ko’: No such file or directory
/lib/modules/4.4.8-hardened-r1/kernel/Documentation/connector/cn_test.ko: No such file or directory
At main.c:255:
- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175
- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178
sign-file: /lib/modules/4.4.8-hardened-r1/kernel/drivers/acpi/button.ko: No such file or directory
scripts/Makefile.modinst:35: recipe for target 'Documentation/connector/cn_test.ko' failed
make[1]: *** [Documentation/connector/cn_test.ko] Error 1
make[1]: *** Waiting for unfinished jobs....
scripts/Makefile.modinst:35: recipe for target 'drivers/acpi/button.ko' failed
make[1]: *** [drivers/acpi/button.ko] Error 1
At main.c:255:
- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175
- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178
sign-file: /lib/modules/4.4.8-hardened-r1/kernel/drivers/block/sx8.ko: No such file or directory
scripts/Makefile.modinst:35: recipe for target 'drivers/block/sx8.ko' failed
make[1]: *** [drivers/block/sx8.ko] Error 1

[swappy]

Disabling

Code: Select all

CONFIG_BUILD_DOCSRC

did the trick for me (hardened profile 4.7.10).

I saw quite a few threads where pwople wondered where that is in the menuconfig, I found it under Kernel hacking/Build targets in Documentation/ tree (press / and search for DOCSRC for example)

Thanks kernelOfTruth for the lead.

Any news for this ?


The offending config option seems to be

Code: Select all

CONFIG_BUILD_DOCSRC=y

and it should work fine on x86_64 but it also doesn't here (I never had this option enabled and per chance had it enabled today for several kernel builds)

so disabling should help

[dataking]

Disabling

Code: Select all

CONFIG_BUILD_DOCSRC

did the trick for me (hardened profile 4.7.10).

I saw quite a few threads where pwople wondered where that is in the menuconfig, I found it under Kernel hacking/Build targets in Documentation/ tree (press / and search for DOCSRC for example)

Thanks kernelOfTruth for the lead.

Any news for this ?


The offending config option seems to be

Code: Select all

CONFIG_BUILD_DOCSRC=y

and it should work fine on x86_64 but it also doesn't here (I never had this option enabled and per chance had it enabled today for several kernel builds)

so disabling should help

+1 Disabling this option worked for me after much facedesking. Very happy to finally get it working.