From: Kees Cook <keescook@chromium.org>
To: Nick Desaulniers <ndesaulniers@google.com>
Cc: Masahiro Yamada <masahiroy@kernel.org>,
Linux Kbuild mailing list <linux-kbuild@vger.kernel.org>,
clang-built-linux <clang-built-linux@googlegroups.com>,
"maintainer:X86 ARCHITECTURE (32-BIT AND 64-BIT)"
<x86@kernel.org>, linux-efi <linux-efi@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 1/2] kbuild: remove cc-option test of -fno-stack-protector
Date: Fri, 26 Jun 2020 13:21:51 -0700 [thread overview]
Message-ID: <202006261319.F130204@keescook> (raw)
In-Reply-To: <CAKwvOd=V_M43CP7G87K3TqSsxua2NcXPz6BnDt-z6167O2WAzQ@mail.gmail.com>
On Fri, Jun 26, 2020 at 01:13:20PM -0700, Nick Desaulniers wrote:
> On Fri, Jun 26, 2020 at 12:00 PM Masahiro Yamada <masahiroy@kernel.org> wrote:
> >
> > +++ b/Makefile
> > @@ -762,7 +762,7 @@ ifneq ($(CONFIG_FRAME_WARN),0)
> > KBUILD_CFLAGS += -Wframe-larger-than=$(CONFIG_FRAME_WARN)
> > endif
> >
> > -stackp-flags-$(CONFIG_CC_HAS_STACKPROTECTOR_NONE) := -fno-stack-protector
> > +stackp-flags-y := -fno-stack-protector
> > stackp-flags-$(CONFIG_STACKPROTECTOR) := -fstack-protector
> > stackp-flags-$(CONFIG_STACKPROTECTOR_STRONG) := -fstack-protector-strong
>
> So it looks like the previous behavior always added
> `-fno-stack-protector` (since CONFIG_CC_HAS_STACKPROTECTOR_NONE was
> always true), but then we append either `-fstack-protector` or
> `-fstack-protector-strong` based on configs. While that's ok, and you
> patch doesn't change that behavior, and it's good to be explicit to
> set the stack protector or not...it seems weird to have
> `-fno-stack-protector -fstack-protector` in the command line flags. I
> would prefer if we checked for not having CONFIG_STACKPROTECTOR or
> CONFIG_STACKPROTECTOR_STRONG before adding `-fno-stack-protector`.
> That doesn't have to be done in this patch, per se.
No, it would add only what was latest and most selected. (They're all
":=" assignments.) If CONFIG_STACKPROTECTOR_STRONG, only
-fstack-protector-strong is set. If only CONFIG_STACKPROTECTOR, only
-fstack-protector is set. Otherwise -fno-stack-protector.
--
Kees Cook
next prev parent reply other threads:[~2020-06-26 20:21 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-06-26 18:59 [PATCH 1/2] kbuild: remove cc-option test of -fno-stack-protector Masahiro Yamada
2020-06-26 18:59 ` [PATCH 2/2] kbuild: remove cc-option test of -ffreestanding Masahiro Yamada
2020-06-26 19:58 ` Nick Desaulniers
2020-06-26 20:22 ` Kees Cook
2020-06-27 7:39 ` Ard Biesheuvel
2020-06-26 19:09 ` [PATCH 1/2] kbuild: remove cc-option test of -fno-stack-protector Nick Desaulniers
2020-06-26 20:00 ` Masahiro Yamada
2020-06-26 20:13 ` Kees Cook
2020-06-26 20:13 ` Nick Desaulniers
2020-06-26 20:21 ` Kees Cook [this message]
2020-06-26 20:25 ` Nick Desaulniers
2020-06-26 20:37 ` Kees Cook
2020-06-27 11:58 ` Masahiro Yamada
2020-06-29 18:26 ` Nick Desaulniers
2020-06-29 22:39 ` Nick Desaulniers
2020-06-30 18:18 ` Masahiro Yamada
2020-07-01 19:33 ` Masahiro Yamada
2020-06-26 20:18 ` Kees Cook
2020-06-27 7:39 ` Ard Biesheuvel
2020-07-01 6:01 ` Marco Elver
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202006261319.F130204@keescook \
--to=keescook@chromium.org \
--cc=clang-built-linux@googlegroups.com \
--cc=linux-efi@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=masahiroy@kernel.org \
--cc=ndesaulniers@google.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).