openssh unix dev - Jun 2018 - vanilla build of 7.7p1 release on linux/4.17 fails with gcc8 @ "/usr/bin/ld: unrecognized option '-Wl,-z,retpolineplt'"

hi

On 6/7/18 4:03 PM, Darren Tucker wrote:
> On 8 June 2018 at 07:09, PGNet Dev <pgnet.dev at gmail.com> wrote:
>> Verifying a report I just got pinged about, building vanilla openssh
7.7p1 on linux configures ok, but fails build around 'retpoline'
> [...]
>> Should the retpoline flag be getting added?  If so, what's needed
to make LD happy with it?
> 
> configure checks to see if the linker accepts those flags, so my guess
> is that something is added later in configure that causes it to fail.
> I suggest looking at config.log to see what the actaul compiler
> messages are from these parts:
> 
> OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
> OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
> 
> and the actual compiler output show up in config.log.
> 
> I wrote and tested this patch against the development versions of gcc
> and clang which was all that was available at the time, it's possible
> the released versions don't behave quite the same.
here's the complete config.log:
https://paste.fedoraproject.org/paste/WtZP~Oe1~es2ddeqCBtCqQ

the 'fun' appears to start at line# 652

	gcc-8: error: unrecognized command line option '-mretpoline'; did you
mean '-Wtrampolines'?

nooooo, no trampolines (is that a thing?) ;-)

at 1st quick look-thru, I'm just seeing that the flag failed, but not _why_.
yet.  looking closer now.

also, just fyi, during my testing I did try clang6 et al as well.  failed as
well, with different/additional errors.  didn't spend any further time on it
yet.

On 8 June 2018 at 09:44, PGNet Dev <pgnet.dev at gmail.com>
wrote:
> hi
>
> On 6/7/18 4:03 PM, Darren Tucker wrote:
>> On 8 June 2018 at 07:09, PGNet Dev <pgnet.dev at gmail.com>
wrote:
>>> Verifying a report I just got pinged about, building vanilla
openssh 7.7p1 on linux configures ok, but fails build around 'retpoline'
>> [...]
>>> Should the retpoline flag be getting added?  If so, what's
needed to make LD happy with it?
>>
>> configure checks to see if the linker accepts those flags, so my guess
>> is that something is added later in configure that causes it to fail.
>> I suggest looking at config.log to see what the actaul compiler
>> messages are from these parts:
>>
>> OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang
>> OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])
>>
>> and the actual compiler output show up in config.log.
>>
>> I wrote and tested this patch against the development versions of gcc
>> and clang which was all that was available at the time, it's
possible
>> the released versions don't behave quite the same.
>
> here's the complete config.log:
https://paste.fedoraproject.org/paste/WtZP~Oe1~es2ddeqCBtCqQ
>
> the 'fun' appears to start at line# 652
that one is fine, it's this which fails and is not tried again:
OSSH_CHECK_CFLAG_COMPILE([-mretpoline]) # clang

This one causing the problem is
"OSSH_CHECK_LDFLAG_LINK([-Wl,-z,retpolineplt])" which is is accepted
but ignored by ld, but later causes an error.

configure:6352: checking if /usr/bin/ld supports link flag -Wl,-z,retpolineplt
configure:6375: /usr/bin/gcc-8 -o conftest -g -O2 -pipe -Wall
-Wpointer-arith -Wuninitialized -Wsign-compare -Wformat-security
-Wsizeof-pointer-memaccess -Wno-pointer-sign -Wno-unused-result
-fno-strict-aliasing -mfunction-return=thunk -mindirect-branch=thunk
-Werror -Wl,-z,retpolineplt conftest.c  >&5
/usr/lib64/gcc/x86_64-suse-linux/8/../../../../x86_64-suse-linux/bin/ld:
warning: -z retpolineplt ignored.
configure:6375: $? = 0
configure:6376: result: yes

I was able to build on Fedora 28 running gcc version 8.1.1 20180502
(Red Hat 8.1.1-1) (GCC) which gives the following command line:

gcc -o sshd sshd.o auth-rhosts.o auth-passwd.o audit.o audit-bsm.o
audit-linux.o platform.o sshpty.o sshlogin.o servconf.o serverloop.o
auth.o auth2.o auth-options.o session.o auth2-chall.o groupaccess.o
auth-skey.o auth-bsdauth.o auth2-hostbased.o auth2-kbdint.o
auth2-none.o auth2-passwd.o auth2-pubkey.o monitor.o monitor_wrap.o
auth-krb5.o auth2-gss.o gss-serv.o gss-serv-krb5.o loginrec.o
auth-pam.o auth-shadow.o auth-sia.o md5crypt.o sftp-server.o
sftp-common.o sandbox-null.o sandbox-rlimit.o sandbox-systrace.o
sandbox-darwin.o sandbox-seccomp-filter.o sandbox-capsicum.o
sandbox-pledge.o sandbox-solaris.o -L. -Lopenbsd-compat/
-Wl,-z,retpolineplt -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-fstack-protector-strong -pie  -lssh -lopenbsd-compat  -lcrypto -ldl
-lutil -lz  -lcrypt -lresolv
/usr/bin/ld: warning: -z retpolineplt ignored.

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.

Also what exact distro and version are you having the problem on and
what version of ld does it have?

Mine is
$ ld --version
GNU ld version 2.29.1-23.fc28

-- 
Darren Tucker (dtucker at dtucker.net)
GPG key 11EAA6FA / A86E 3E07 5B19 5880 E860  37F4 9357 ECEF 11EA A6FA (new)
    Good judgement comes with experience. Unfortunately, the experience
usually comes from bad judgement.