From: Josh Poimboeuf <[email protected]> Enable CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL for ark. This prevents a lot of uninitialized stack variable exploits, with a minimal impact on performance.
This feature is incompatible with CONFIG_KASAN, so it can't be enabled on debug kernels. Also, it's mutually exclusive with CONFIG_INIT_STACK_NONE=y. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1856176 Signed-off-by: Josh Poimboeuf <[email protected]> --- .../generic => ark/debug}/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | 0 .../configs/{common/generic => ark/debug}/CONFIG_INIT_STACK_NONE | 0 .../configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | 1 + redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE | 1 + redhat/configs/ark/generic/CONFIG_INIT_STACK_NONE | 1 + .../fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL | 1 + redhat/configs/fedora/generic/CONFIG_INIT_STACK_NONE | 1 + 7 files changed, 5 insertions(+) rename redhat/configs/{common/generic => ark/debug}/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL (100%) rename redhat/configs/{common/generic => ark/debug}/CONFIG_INIT_STACK_NONE (100%) create mode 100644 redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL create mode 100644 redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE create mode 100644 redhat/configs/ark/generic/CONFIG_INIT_STACK_NONE create mode 100644 redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL create mode 100644 redhat/configs/fedora/generic/CONFIG_INIT_STACK_NONE diff --git a/redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL b/redhat/configs/ark/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL similarity index 100% rename from redhat/configs/common/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL rename to redhat/configs/ark/debug/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL diff --git a/redhat/configs/common/generic/CONFIG_INIT_STACK_NONE b/redhat/configs/ark/debug/CONFIG_INIT_STACK_NONE similarity index 100% rename from redhat/configs/common/generic/CONFIG_INIT_STACK_NONE rename to redhat/configs/ark/debug/CONFIG_INIT_STACK_NONE diff --git a/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL b/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL new file mode 100644 index 000000000000..1713b5628e90 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL @@ -0,0 +1 @@ +CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y diff --git a/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE b/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE new file mode 100644 index 000000000000..321ed2054eca --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE @@ -0,0 +1 @@ +# CONFIG_GCC_PLUGIN_STRUCTLEAK_VERBOSE is not set diff --git a/redhat/configs/ark/generic/CONFIG_INIT_STACK_NONE b/redhat/configs/ark/generic/CONFIG_INIT_STACK_NONE new file mode 100644 index 000000000000..37f7832f62d2 --- /dev/null +++ b/redhat/configs/ark/generic/CONFIG_INIT_STACK_NONE @@ -0,0 +1 @@ +# CONFIG_INIT_STACK_NONE is not set diff --git a/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL new file mode 100644 index 000000000000..83bd543915b6 --- /dev/null +++ b/redhat/configs/fedora/generic/CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL @@ -0,0 +1 @@ +# CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL is not set diff --git a/redhat/configs/fedora/generic/CONFIG_INIT_STACK_NONE b/redhat/configs/fedora/generic/CONFIG_INIT_STACK_NONE new file mode 100644 index 000000000000..16e74023a918 --- /dev/null +++ b/redhat/configs/fedora/generic/CONFIG_INIT_STACK_NONE @@ -0,0 +1 @@ +CONFIG_INIT_STACK_NONE=y -- GitLab _______________________________________________ kernel mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/[email protected]
