Skip to content

linux: fix canister reverse-relocation section numbering #33

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dcasota wants to merge 1 commit into from
Closed

linux: fix canister reverse-relocation section numbering #33

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion SPECS/linux/canister_builder/crypto/gen_canister_relocs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -399,8 +399,23 @@ static void parse_sections(Elf *elf, size_t shstrndx, int *n_syms, size_t *strnd
/*
* ndx - section index in inout file.
* ondx - section index in generated .c file
*
* ondx is what fips_integrity_init() uses to index its si[]
* array, and si[] is built from canister_sections[], which
* holds only the sections that have both markers. A section
* with no end marker - .bss - is not measured and therefore
* not in si[], so it must not consume an ondx. If it does,
* every section that follows it is numbered one too high and
* its reverse relocations are applied to the wrong section.
*
* This used to be harmless only because .bss happened to be
* laid out after every measured section; that is a property
* of the compiler, not something we may rely on.
*/
section_symbols[ndx]->ondx = ondx++;
if (section_symbols[ndx]->end)
section_symbols[ndx]->ondx = ondx++;
else
section_symbols[ndx]->ondx = -1;
}
if (!symtab)
error("Unable to find .symtab section");
Expand Down
7 changes: 6 additions & 1 deletion SPECS/linux/linux.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@
Summary: Kernel
Name: linux
Version: 6.12.109
Release: 1%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
Release: 2%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist}
URL: http://www.kernel.org/
Group: System Environment/Kernel
Vendor: VMware, Inc.
Expand Down Expand Up @@ -992,6 +992,11 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
%endif

%changelog
* Sat Sep 12 2026 Daniel Casota <dcasota@gmail.com> 6.12.109-2
- gen_canister_relocs: do not let the unmeasured .bss section consume a
section index, which misdirected reverse relocations and broke FIPS
canister verification when the compiler placed .bss before a measured
section
* Fri Sep 11 2026 Ajay Kaher <ajay.kaher@broadcom.com> 6.12.109-1
- Update to version 6.12.109
* Fri Sep 11 2026 Ajay Kaher <ajay.kaher@broadcom.com> 6.12.107-11
Expand Down