[PATCH v5 3/5] security: Replace indirect LSM hook calls with static calls

[KP Singh]

On Sat, Sep 30, 2023 at 10:40 PM Kees Cook <keescook at chromium.org> wrote:
>
> On Sun, Oct 01, 2023 at 12:13:06AM +0800, kernel test robot wrote:
> > Hi KP,
> >
> > kernel test robot noticed the following build errors:
> >
> > [auto build test ERROR on bpf-next/master]
> > [also build test ERROR on bpf/master pcmoore-selinux/next linus/master v6.6-rc3 next-20230929]
> > [If your patch is applied to the wrong git tree, kindly drop us a note.
> > And when submitting patch, we suggest to use '--base' as documented in
> > https://git-scm.com/docs/git-format-patch#_base_tree_information]
> >
> > url:    https://github.com/intel-lab-lkp/linux/commits/KP-Singh/kernel-Add-helper-macros-for-loop-unrolling/20230929-042610
> > base:   https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git master
> > patch link:    https://lore.kernel.org/r/20230928202410.3765062-4-kpsingh%40kernel.org
> > patch subject: [PATCH v5 3/5] security: Replace indirect LSM hook calls with static calls
> > config: i386-randconfig-001-20230930 (https://download.01.org/0day-ci/archive/20230930/202309302332.1mxVwb0U-lkp@intel.com/config)
> > compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230930/202309302332.1mxVwb0U-lkp@intel.com/reproduce)
> >
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp at intel.com>
> > | Closes: https://lore.kernel.org/oe-kbuild-all/202309302332.1mxVwb0U-lkp@intel.com/
> >
> > All errors (new ones prefixed by >>):
> >
> > >> security/security.c:139:1: error: Only string constants are supported as initializers for randomized structures with flexible arrays
> >      139 | };
> >          | ^
>
> Uuh, where is there a flexible array here?

I cannot seem to reproduce this with my gcc

wget https://download.01.org/0day-ci/archive/20230930/202309302332.1mxVwb0U-lkp@intel.com/config
mkdir build_dir && cp config build_dir/.config
make -j  64 W=1 O=build_dir ARCH=i386 olddefconfig
make -j 64  W=1 O=build_dir ARCH=i386 SHELL=/bin/bash
history

on bpf-next/master builds the kernel for me:

Kernel: arch/x86/boot/bzImage is ready  (#1)

The reproducer does not seem to come with a tool chain, and I even
hacked the make.cross from another similar reply for gcc-9 and it
still seems to work. Not sure what happened in the CI there.




>
> > vim +139 security/security.c
> >
> >    118
> >    119        /*
> >    120         * Initialise a table of static calls for each LSM hook.
> >    121         * DEFINE_STATIC_CALL_NULL invocation above generates a key (STATIC_CALL_KEY)
> >    122         * and a trampoline (STATIC_CALL_TRAMP) which are used to call
> >    123         * __static_call_update when updating the static call.
> >    124         */
> >    125        struct lsm_static_calls_table static_calls_table __ro_after_init = {
> >    126        #define INIT_LSM_STATIC_CALL(NUM, NAME)                                 \
> >    127                (struct lsm_static_call) {                                      \
> >    128                        .key = &STATIC_CALL_KEY(LSM_STATIC_CALL(NAME, NUM)),    \
> >    129                        .trampoline = LSM_HOOK_TRAMP(NAME, NUM),                \
> >    130                        .active = &SECURITY_HOOK_ACTIVE_KEY(NAME, NUM),         \
> >    131                },
> >    132        #define LSM_HOOK(RET, DEFAULT, NAME, ...)                               \
> >    133                .NAME = {                                                       \
> >    134                        LSM_DEFINE_UNROLL(INIT_LSM_STATIC_CALL, NAME)           \
> >    135                },
> >    136        #include <linux/lsm_hook_defs.h>
> >    137        #undef LSM_HOOK
> >    138        #undef INIT_LSM_STATIC_CALL
> >  > 139        };
> >    140
>
> *confused*
>
> -Kees
>
> --
> Kees Cook