[Bug 1940029] Re: Default of fcf-protection should only be enabled where it can work

[Christian Ehrhardt ]

My original case was in Impish and later.
I see the patch you applied and I see that it changes based on the presence of -m16


Due to linking with 16 bit being rather, ... special :-)
I can't use my trivial test that I found back then to be sure.
I thought of re-building qemu against gcc-10 in Focal (but that might hit all kind of other things we do not want to look for).

Gladly all we care is if fcf-protection is effectively set or not - and
that we can do without the weird 16 bit linking.


Pre-fix:
root at f2:~# gcc-10 -Q -v -march=i486 -m16 -Wall -Werror test.c -o test.o |& grep -e fcf -e "GNU C17"
 /usr/lib/gcc/x86_64-linux-gnu/10/cc1 -v -imultiarch x86_64-linux-gnu test.c -dumpbase test.c -march=i486 -m16 -auxbase test -Wall -Werror -version -fasynchronous-unwind-tables -fstack-protector-strong -Wformat-security -fstack-clash-protection -fcf-protection -o /tmp/cc6LBUMj.s
GNU C17 (Ubuntu 10.3.0-1ubuntu1~20.04) version 10.3.0 (x86_64-linux-gnu)
GNU C17 (Ubuntu 10.3.0-1ubuntu1~20.04) version 10.3.0 (x86_64-linux-gnu)
 -Wformat-security -fstack-clash-protection -fcf-protection

Post-fix:
root at f:~# gcc-10 -Q -v -march=i486 -m16 -Wall -Werror test.c -o test.o |& grep -e fcf -e "GNU C17"
GNU C17 (Ubuntu 10.5.0-1ubuntu1~20.04) version 10.5.0 (x86_64-linux-gnu)
GNU C17 (Ubuntu 10.5.0-1ubuntu1~20.04) version 10.5.0 (x86_64-linux-gnu)


So you see that with the fix in the -m16 case "-fcf-protection" is gone.
\o/


BTW as I found above in theory we'd also want to disable that for march=i486 in general?
But if that is a bug worth addressing (split it to a new one then) is up to you.

** Tags removed: verification-needed-focal
** Tags added: verification-done-focal

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to gcc-10 in Ubuntu.
https://bugs.launchpad.net/bugs/1940029

Title:
  Default of fcf-protection should only be enabled where it can work

Status in gcc-10 package in Ubuntu:
  Fix Released
Status in gcc-11 package in Ubuntu:
  Fix Released
Status in gcc-12 package in Ubuntu:
  Fix Released
Status in qemu package in Ubuntu:
  Fix Released
Status in gcc-10 source package in Focal:
  Fix Committed
Status in gcc-12 source package in Jammy:
  Fix Released

Bug description:
  Hi,
  I've happened to find this breaking a qemu build that was breaking like:

  
  c -MMD -MP -MT linuxboot_dma.o -MF ./linuxboot_dma.d -O2 -g -march=i486 -Wall -Wstrict-prototypes -Wredundant-decls -Wundef -Wwrite-strings -Wmissing-prototypes -Wformat -Werror=format-security -Wdate-time -Wold-style-declaration -Wold-style-definition -Wtype-limits -Wformat-security -Wformat-y2k -Winit-self -Wignored-qualifiers -Wempty-body -Wnested-externs -Wendif-labels -Wexpansion-to-defined -Wimplicit-fallthrough=2 -Wno-missing-include-dirs -Wno-shift-negative-value -Wno-psabi -fno-pie -ffreestanding -I/<<PKGBUILDDIR>>/pc-bios/optionrom//../../include   -fno-stack-protector   -m16   -Wa,-32 -c /<<PKGBUILDDIR>>/pc-bios/optionrom/linuxboot_dma.c -o linuxboot_dma.o
  cc1: error: ‘-fcf-protection’ is not compatible with this target                 

  As usual this looks complex but it can be reduced to your favorite C
  hello world.

  It should work if you build it with:
    $ cc -Wall -Werror test.c -o test.o

  But the following will fail:
    $ cc -Wall -Werror -march=i486 -m16 test.c -o test.o
  cc1: error: ‘-fcf-protection’ is not compatible with this target

  
  This is some of the always crazy boot blobs that virtualization needs here and there - and I hope I can resolve it for qemu in the build. But in general while I think the fcf default (https://wiki.ubuntu.com/ToolChain/CompilerFlags#A-fcf-protection) is ok, it should not be default on arch combinations where it can never work.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gcc-10/+bug/1940029/+subscriptions