| From | "Hou Wenlong" <> | Subject | [PATCH RFC 17/43] x86/pie: Enable stack protector only if per-cpu stack canary is supported | Date | Fri, 28 Apr 2023 17:50:57 +0800 |
| |
Since -fPIE option is not incompatible with -mcmode=kernel option, PIE kernel would drop -mcmodel=kernel option. However, GCC would use %fs as segment register for stack protector when -mcmodel=kernel option is dropped. So only enable stack protector for PIE kernel if per-cpu stack canary is supported.
Signed-off-by: Hou Wenlong <houwenlong.hwl@antgroup.com> Cc: Thomas Garnier <thgarnie@chromium.org> Cc: Lai Jiangshan <jiangshan.ljs@antgroup.com> Cc: Kees Cook <keescook@chromium.org> --- arch/x86/Kconfig | 1 + 1 file changed, 1 insertion(+)
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig index 55cce8cdf9bd..b26941ef50ee 100644 --- a/arch/x86/Kconfig +++ b/arch/x86/Kconfig @@ -403,6 +403,7 @@ config PGTABLE_LEVELS config CC_HAS_SANE_STACKPROTECTOR bool + default CC_HAS_CUSTOMIZED_STACKPROTECTOR if X86_PIE default $(success,$(srctree)/scripts/gcc-x86_64-has-stack-protector.sh $(CC) $(CLANG_FLAGS)) if 64BIT default $(success,$(srctree)/scripts/gcc-x86_32-has-stack-protector.sh $(CC) $(CLANG_FLAGS)) help -- 2.31.1
|