Commit e06b8b98 authored Feb 13, 2008 by Sam Ravnborg

kbuild: allow -fstack-protector to take effect



Arjan van de Ven <arjan@infradead.org> wrote:
===
I just read the excellent LWN writeup of the vmsplice
security thing, and that got me wondering why this attack
wasn't stopped by the CONFIG_CC_STACKPROTECTOR option...
because it plain should have been...

Some analysis later.. it turns out that the following line
in the top level Makefile, added by you in October 2007,
entirely disables CONFIG_CC_STACKPROTECTOR ;(
With this line removed the exploit will be nicely stopped.

CFLAGS          += $(call cc-option, -fno-stack-protector)

Now I realize that certain distros have patched gcc to
compensate for their lack of distro wide CFLAGS, and it's
great to work around that... but would there be a way to NOT
disable this for CONFIG_CC_STACKPROTECTOR please?
It would have made this exploit not possible for those kernels
that enable this feature (and that includes distros like Fedora)
===

Move the assignment to KBUILD_CFLAGS up before including
the arch specific Makefile so arch makefiles may override
the setting.

Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
Cc: Arjan van de Ven <arjan@infradead.org>
Cc: stable@kernel.org

parent 587c9061

Makefile

+4 −3

Original line number	Original line	Diff line number	Diff line
	@@ -507,6 +507,10 @@ else
	KBUILD_CFLAGS += -O2		KBUILD_CFLAGS += -O2
	endif		endif

			# Force gcc to behave correct even for buggy distributions
			# Arch Makefiles may override this setting
			KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)

	include $(srctree)/arch/$(SRCARCH)/Makefile		include $(srctree)/arch/$(SRCARCH)/Makefile

	ifdef CONFIG_FRAME_POINTER		ifdef CONFIG_FRAME_POINTER
	@@ -525,9 +529,6 @@ ifdef CONFIG_DEBUG_SECTION_MISMATCH
	KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)		KBUILD_CFLAGS += $(call cc-option, -fno-inline-functions-called-once)
	endif		endif

	# Force gcc to behave correct even for buggy distributions
	KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)

	# arch Makefile may override CC so keep this after arch Makefile is included		# arch Makefile may override CC so keep this after arch Makefile is included
	NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)		NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
	CHECKFLAGS += $(NOSTDINC_FLAGS)		CHECKFLAGS += $(NOSTDINC_FLAGS)

Admin message