linux-kernel - Re: [PATCH -v1.1] kbuild: Steal gcc's pie from the very beginning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 15 Nov 2016 17:08:09 +0100
From:   Michal Marek <mmarek@...e.com>
To:     Borislav Petkov <bp@...en8.de>
Cc:     Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
        linux-kbuild@...r.kernel.org, Ben Hutchings <ben@...adent.org.uk>,
        x86-ml <x86@...nel.org>, lkml <linux-kernel@...r.kernel.org>,
        +@...tnic
Subject: Re: [PATCH -v1.1] kbuild: Steal gcc's pie from the very beginning

On Mon, Nov 14, 2016 at 09:45:29PM +0100, Borislav Petkov wrote:
> From: Borislav Petkov <bp@...e.de>
> Date: Mon, 14 Nov 2016 19:41:31 +0100
> Subject: [PATCH] kbuild: Steal gcc's pie from the very beginning
> 
> So Sebastian turned off the PIE for kernel builds but that was too late
> - Kbuild.include already uses KBUILD_CFLAGS and trying to disable gcc
> options with, say cc-disable-warning, fails:
> 
>   gcc -D__KERNEL__ -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs
>   ...
>   -Wno-sign-compare -fno-asynchronous-unwind-tables -Wframe-address -c -x c /dev/null -o .31392.tmp
>   /dev/null:1:0: error: code model kernel does not support PIC mode
> 
> because that returns an error and we can't disable the warning. For
> example in this case:
> 
> KBUILD_CFLAGS   += $(call cc-disable-warning,frame-address,)
> 
> which leads to gcc issuing all those warnings again.
> 
> So let's turn off PIE/PIC at the earliest possible moment, when we
> declare KBUILD_CFLAGS so that cc-disable-warning picks it up too.
> 
> Also, we need the $(call cc-option ...) because -fno-PIE is supported
> since gcc v3.4 and our lowest supported gcc version is 3.2 right now.
> 
> Signed-off-by: Borislav Petkov <bp@...e.de>
> Cc: stable@...r.kernel.org
> Cc: Ben Hutchings <ben@...adent.org.uk>
> Cc: Michal Marek <mmarek@...e.com>
> Cc: Sebastian Andrzej Siewior <bigeasy@...utronix.de>

Thanks, applied to kbuild.git#rc-fixes.

Michal