public-mirrors/linux
1
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-18 22:14:16 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

kstack_erase: Support Clang stack depth tracking

Browse source 
Wire up CONFIG_KSTACK_ERASE to Clang 21's new stack depth tracking
callback[1] option.

Link: https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-stack-depth [1]
Acked-by: Nicolas Schier <n.schier@avm.de>
Link: https://lore.kernel.org/r/20250724055029.3623499-4-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Kees Cook 2025-07-23 22:50:28 -07:00
parent 6676fd3c99
commit a8f0b1f8ef
2 changed files with 10 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
scripts/Makefile.kstack_erase
View file

@ -8,6 +8,12 @@ kstack-erase-cflags-$(CONFIG_GCC_PLUGIN_STACKLEAK_VERBOSE) += -fplugin-arg-stack
DISABLE_KSTACK_ERASE := -fplugin-arg-stackleak_plugin-disable
endif
ifdef CONFIG_CC_IS_CLANG
kstack-erase-cflags-y += -fsanitize-coverage=stack-depth
kstack-erase-cflags-y += -fsanitize-coverage-stack-depth-callback-min=$(CONFIG_KSTACK_ERASE_TRACK_MIN_SIZE)
DISABLE_KSTACK_ERASE := -fno-sanitize-coverage=stack-depth
endif
KSTACK_ERASE_CFLAGS := $(kstack-erase-cflags-y)
export STACKLEAK_CFLAGS DISABLE_KSTACK_ERASE

5
security/Kconfig.hardening
View file

@ -82,10 +82,13 @@ choice
endchoice
config CC_HAS_SANCOV_STACK_DEPTH_CALLBACK
def_bool $(cc-option,-fsanitize-coverage-stack-depth-callback-min=1)
config KSTACK_ERASE
bool "Poison kernel stack before returning from syscalls"
depends on HAVE_ARCH_KSTACK_ERASE
depends on GCC_PLUGINS
depends on GCC_PLUGINS || CC_HAS_SANCOV_STACK_DEPTH_CALLBACK
help
This option makes the kernel erase the kernel stack before
returning from system calls. This has the effect of leaving