On Tue, 6 Jan 2026 13:18:36 -0800 "H. Peter Anvin" <[email protected]> wrote:
Hi everyone,
I ran the tip master branch through my AI review prompts and this one was
flagged. These look right to me, apologies if it's noise:
> diff --git a/arch/x86/entry/vdso/common/Makefile.include
> b/arch/x86/entry/vdso/common/Makefile.include
> new file mode 100644
> index 0000000000000..3514b4a6869b7
> --- /dev/null
> +++ b/arch/x86/entry/vdso/common/Makefile.include
[ ... ]
> +#
> +# Options from KBUILD_[AC]FLAGS that should *NOT* be kept
> +#
> +flags-remove-y += \
> + -D__KERNEL__ -mcmodel=kernel -mregparm=3 \
> + -fno-pic -fno-PIC -fno-pie fno-PIE \
^^^^^^^
Should this be "-fno-PIE" with the leading dash? The other flags in this
line all have the dash prefix, but "fno-PIE" is missing it. Without the
dash, filter-out won't match the actual compiler flag.
> + -mfentry -pg \
> + $(RANDSTRUCT_CFLAGS) $(GCC_PLUGIN_CFLAGS) $(KSTACK_ERASE_CFLAGS) \
^^^^^^^^^^^^^^^^^
Is GCC_PLUGIN_CFLAGS the right variable name here? The kbuild system
defines GCC_PLUGINS_CFLAGS (with an 's') in scripts/Makefile.gcc-plugins.
Other vDSO Makefiles (arm64, sparc, arm) use GCC_PLUGINS_CFLAGS. Without
the fix, gcc plugin flags won't be filtered out when CONFIG_GCC_PLUGINS=y.
> + $(RETPOLINE_CFLAGS) $(CC_FLAGS_LTO) $(CC_FLAGS_CFI) \
> + $(PADDING_CFLAGS)
[ ... ]
> +# Reset cf protections enabled by compiler default
> +flags-y += $(call cc-option, -fcf-protection=none)
> +flags-$(X86_USER_SHADOW_STACK) += $(call cc-option, -fcf-protection=return)
^^^^^^^^^^^^^^^^^^^^^
Should this be CONFIG_X86_USER_SHADOW_STACK? The Kconfig symbol is defined
as "config X86_USER_SHADOW_STACK" and kbuild exposes it as a CONFIG_
prefixed variable. The next lines show the pattern:
> +# When user space IBT is supported, enable this.
> +# flags-$(CONFIG_USER_IBT) += $(call cc-option, -fcf-protection=branch)
> +
> +flags-$(CONFIG_MITIGATION_RETPOLINE) += $(RETPOLINE_VDSO_CFLAGS)
Both of these correctly use the CONFIG_ prefix. Without it, the shadow
stack cf-protection flag will never be added to vDSO builds even when
CONFIG_X86_USER_SHADOW_STACK=y.
