# kernel build at hardened fails in vdso_standalone_test_x86

## toralf

me wonders about this at a stable hardened server:

```
randconfig failed for v3.19-rc5 :...

  HOSTCC  Documentation/prctl/disable-tsc-on-off-stress-test

  HOSTCC  Documentation/prctl/disable-tsc-test

  HOSTCC  Documentation/ptp/testptp

  HOSTCC  Documentation/spi/spidev_test

  HOSTCC  Documentation/spi/spidev_fdx

  HOSTCC  Documentation/timers/hpet_example

  HOSTCC  Documentation/vDSO/vdso_standalone_test_x86.o

  HOSTCC  Documentation/vDSO/parse_vdso.o

  HOSTLD  Documentation/vDSO/vdso_standalone_test_x86

/usr/lib/gcc/x86_64-pc-linux-gnu/4.8.3/../../../../x86_64-pc-linux-gnu/bin/ld: Documentation/vDSO/parse_vdso.o: undefined reference to symbol '__stack_chk_fail@@GLIBC_2.4'

/lib64/libc.so.6: error adding symbols: DSO missing from command line

collect2: error: ld returned 1 exit status

scripts/Makefile.host:100: recipe for target 'Documentation/vDSO/vdso_standalone_test_x86' failed

make[2]: *** [Documentation/vDSO/vdso_standalone_test_x86] Error 1

scripts/Makefile.build:402: recipe for target 'Documentation/vDSO' failed

make[1]: *** [Documentation/vDSO] Error 2

Makefile:917: recipe for target 'vmlinux' failed

make: *** [vmlinux] Error 2

#
```

 Any hints ?Last edited by toralf on Sun Jan 18, 2015 8:55 pm; edited 1 time in total

----------

## kernelOfTruth

perhaps you switched between gcc versions and you're using a different one than the one you used to build glibc ?

that's all that comes to mind at the moment

hope that helps ...

*good luck* !

----------

## toralf

well, no, there's just one gcc at that system since a loong time :

```
tor-relay /usr/src/linux # gcc-config -l

 [1] x86_64-pc-linux-gnu-4.8.3 *

 [2] x86_64-pc-linux-gnu-4.8.3-hardenednopie

 [3] x86_64-pc-linux-gnu-4.8.3-hardenednopiessp

 [4] x86_64-pc-linux-gnu-4.8.3-hardenednossp

 [5] x86_64-pc-linux-gnu-4.8.3-vanilla

tor-relay /usr/src/linux # qlop --gauge --human gcc

Fri Oct 24 23:04:35 2014 >>> sys-devel/gcc-4.7.3-r1

Sat Oct 25 01:55:30 2014 >>> sys-devel/gcc-4.8.3

Sat Oct 25 02:03:03 2014 >>> sys-devel/gcc-config-1.7.3

Sat Oct 25 10:28:55 2014 >>> sys-devel/gcc-config-1.7.3

Sat Oct 25 12:53:47 2014 >>> sys-devel/gcc-4.8.3

Sat Oct 25 14:23:51 2014 >>> sys-devel/gcc-4.7.3-r1

gcc: Fri Oct 24 22:33:34 2014: 31 minutes, 1 second

gcc: Sat Oct 25 01:22:36 2014: 32 minutes, 54 seconds

gcc: Sat Oct 25 03:28:33 2014: 9 hours, 25 minutes, 14 seconds

gcc: Sat Oct 25 13:47:29 2014: 36 minutes, 22 seconds

gcc: 4 times

```

----------

## Hu

What is the command line used for building the failed DSO?

----------

## toralf

A .config example is here : http://article.gmane.org/gmane.linux.kernel/1868542

And this is the script I'm using

```

tor-relay /mnt/qa/kernel # cat kernel_qa_test.sh 

#!/bin/bash

#  Toralf Förster

#  Hamburg

#  Germany

mailto=tor-relay@zwiebeltoralf.de

export KCONFIG_ALLCONFIG=~/kernel_qa_test.cfg

cd ~/linux

d1=0

while [[ true ]]

do

  d2=$(date +%s)

  diff=$(echo $d2 - $d1 | bc)

  if [[ $diff -gt 86400 ]]; then

    git pull 1>make.log 2>&1 && d1=$d2

  fi

  make mrproper                 1>make.log 2>&1

  make randconfig               1>make.log 2>&1

  yes "" | make silentoldconfig 1>make.log 2>&1

  make                          1>make.log 2>&1

  if [[ $? -ne 0 ]]; then

    (

      echo "randconfig failed for $(git describe) :"

      echo -e "\n..."

      grep -B 15 'Error 2' make.log || tail -n 15 make.log

      echo

      cat .config

    ) | mail -s "randconfig issue" $mailto

    d1=0        #       force a sync

  fi

done

cat make.log | mail -s "randconfig finished with rc=$?" $mailto

exit

```

with this .config defaults

```

tor-relay /mnt/qa/kernel # cat kernel_qa_test.cfg 

#  default kernel config options

#

#

#

CONFIG_ENABLE_WARN_DEPRECATED=n

#  obsolete

#

CONFIG_ISDN=n

CONFIG_SOUND_OSS=n

CONFIG_SOUND_OSS_CORE=n

CONFIG_PRIME=n

CONFIG_X86_NUMAQ=n

CONFIG_IDE=n

#  external file required otherwise

#

CONFIG_STANDALONE=y

CONFIG_FW_LOADER=n

CONFIG_PREVENT_FIRMWARE_BUILD=y

#  never ever

#

CONFIG_FIRMWARE_IN_KERNEL=n

#  buggy per definition

#

CONFIG_STAGING=n

#  bloat up compile time and size

#

CONFIG_DEBUG_INFO=n

#  too much driver mess

#

CONFIG_MEDIA_SUPPORT=n

```

----------

## mv

Maybe it is a red herring, but the error is the same as in this bug.

It seems that something related to the hardening patches to gcc (which apply also to non-hardened gcc) is broken.

In the lack of understanding how it should work, I am unfortunately not able to understand what does not work, here...

----------

## Hu

I meant, what is the specific command that make runs to build that DSO, not what command you use to run make.  Although, since you shared the script, I have a few suggestions for improvements.

```
while [[ true ]]
```

This can be written as while :; or while true;.  Using brackets without an operator is equivalent to test -n true, which is true when the string true is not empty.

```
  if [[ $diff -gt 86400 ]]; then

    git pull 1>make.log 2>&1 && d1=$d2

  fi

  make mrproper                 1>make.log 2>&1

  make randconfig               1>make.log 2>&1

  yes "" | make silentoldconfig 1>make.log 2>&1

  make                          1>make.log 2>&1

  if [[ $? -ne 0 ]]; then

```

This tests only whether the final make succeeds, but ignores any errors returned from earlier steps.  Kernel makes generally should not fail the earlier steps, but if one did, subsequent commands might fail in unexpected ways.  This also leads to another problem: each of these commands truncates make.log on startup, so the only way to get the output of any commands other than the bare make is if a signal kills the whole script.  You could rewrite this as:

```

{ 

  if [[ $diff -gt 86400 ]]; then

    git pull && d1=$d2

  fi

  make mrproper &&

  make randconfig &&

  yes "" | make silentoldconfig &&

  make

} 1>make.log 2>&1

```

This would bail out early if any step other than the git pull fails.  By redirecting the output of the braced expression, make.log is only truncated once, at the beginning, so output from each make will be included.

```
cat make.log | mail -s "randconfig finished with rc=$?" $mailto
```

Useless Use Of Cat.  You can redirect stdin for mail instead.

----------

## toralf

Thx (well, in the origin script I do have a date instead of cat, and usually I do have "&&\" in the make - sequence, but yes, there's room for improvement)

And special thx for this

 *Quote:*   

> Code:	
> 
> while [[ true ]]	
> 
> This can be written as while :; or while true;. Using brackets without an operator is equivalent to test -n true, which is true when the string true is not empty. 

  :Smile: 

----------

## kernelOfTruth

Any news for this ?

The offending config option seems to be 

```
CONFIG_BUILD_DOCSRC=y
```

and it should work fine on x86_64 but it also doesn't here (I never had this option enabled and per chance had it enabled today for several kernel builds)

so disabling should help

----------

## frankenputer

Same snafu

```
  LD      Documentation/video4linux/built-in.o

  HOSTCC  Documentation/watchdog/src/watchdog-simple

  HOSTLD  Documentation/vDSO/vdso_standalone_test_x86

collect2: error: ld returned 1 exit status

scripts/Makefile.host:134: recipe for target 'Documentation/vDSO/vdso_standalone_test_x86' failed

make[2]: *** [Documentation/vDSO/vdso_standalone_test_x86] Error 1

scripts/Makefile.build:403: recipe for target 'Documentation/vDSO' failed

make[1]: *** [Documentation/vDSO] Error 2

make[1]: *** Waiting for unfinished jobs....

  HOSTCC  Documentation/watchdog/src/watchdog-test

Makefile:922: recipe for target 'vmlinux' failed

make: *** [vmlinux] Error 2

  INSTALL Documentation/connector/cn_test.ko

  INSTALL drivers/acpi/button.ko

  INSTALL drivers/block/sx8.ko

cp: cannot stat ‘Documentation/connector/cn_test.ko’: No such file or directory

cp: cannot stat ‘drivers/acpi/button.ko’: No such file or directory

At main.c:255:

- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175

- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178

sign-file: cp: cannot stat ‘drivers/block/sx8.ko’: No such file or directory

/lib/modules/4.4.8-hardened-r1/kernel/Documentation/connector/cn_test.ko: No such file or directory

At main.c:255:

- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175

- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178

sign-file: /lib/modules/4.4.8-hardened-r1/kernel/drivers/acpi/button.ko: No such file or directory

scripts/Makefile.modinst:35: recipe for target 'Documentation/connector/cn_test.ko' failed

make[1]: *** [Documentation/connector/cn_test.ko] Error 1

make[1]: *** Waiting for unfinished jobs....

scripts/Makefile.modinst:35: recipe for target 'drivers/acpi/button.ko' failed

make[1]: *** [drivers/acpi/button.ko] Error 1

At main.c:255:

- SSL error:02001002:system library:fopen:No such file or directory: bss_file.c:175

- SSL error:2006D080:BIO routines:BIO_new_file:no such file: bss_file.c:178

sign-file: /lib/modules/4.4.8-hardened-r1/kernel/drivers/block/sx8.ko: No such file or directory

scripts/Makefile.modinst:35: recipe for target 'drivers/block/sx8.ko' failed

make[1]: *** [drivers/block/sx8.ko] Error 1
```

----------

## swappy

Disabling 

```
CONFIG_BUILD_DOCSRC
```

 did the trick for me (hardened profile 4.7.10).

I saw quite a few threads where pwople wondered where that is in the menuconfig, I found it under Kernel hacking/Build targets in Documentation/ tree (press / and search for DOCSRC for example)

Thanks kernelOfTruth for the lead.

 *kernelOfTruth wrote:*   

> Any news for this ?
> 
> The offending config option seems to be 
> 
> ```
> ...

 

----------

## dataking

 *swappy wrote:*   

> Disabling 
> 
> ```
> CONFIG_BUILD_DOCSRC
> ```
> ...

 

+1  Disabling this option worked for me after much facedesking.  Very happy to finally get it working.   :Wink: 

----------

