linux-kernel - Re: [GIT PULL] hardening updates for v6.18-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wgZjUk4Cy2XgNkTrQoO8XCmNUHrTe5D519Fij1POK+3qw@mail.gmail.com>
Date: Mon, 29 Sep 2025 17:59:17 -0700
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Kees Cook <kees@...nel.org>
Cc: linux-kernel@...r.kernel.org, Andy Shevchenko <andy@...nel.org>, 
	Christopher Fore <csfore@...teo.net>, "Gustavo A. R. Silva" <gustavoars@...nel.org>, 
	Junjie Cao <junjie.cao@...el.com>, 
	Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>, 
	Linus Walleij <linus.walleij@...aro.org>, Nathan Chancellor <nathan@...nel.org>, 
	Philipp Zabel <p.zabel@...gutronix.de>, Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: [GIT PULL] hardening updates for v6.18-rc1

On Mon, 29 Sept 2025 at 12:15, Kees Cook <kees@...nel.org> wrote:
>
> Please pull these hardening updates for v6.18-rc1. One notable addition
> is the creation of the "transitional" keyword for kconfig so CONFIG
> renaming can go more smoothly. This has been a long-standing deficiency,
> and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will
> soon have KCFI support), this came up again. The breadth of the diffstat
> is mainly this renaming.

So I really like this addition conceptually, but it doesn't actually
seem to work.

My clang-building tree config had

    CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
    # CONFIG_CFI_CLANG is not set
    CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y

but then when I pulled this and did a "make oldconfig" I get Kconfig asking me

    Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW)

anyway, in order to get

    CONFIG_ARCH_SUPPORTS_CFI=y
    # CONFIG_CFI is not set
    CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y

and I thought the whole point was that it would recognize the old
Kconfig names and transition them to the new ones. And it very clearly
does not.

So I'm a bit disappointed. Possibly because I expected the
"transitional" keyword to be doing more than it does. But possibly
because it's buggy and doesn't actually do what it is *supposed* to
do.

Hmm?

I've pulled this because it doesn't seem wrong, but it does seem to be
less capable than what I was expecting / hoping it to be.

In other words: the long-standing deficiency still stands tall and not-so-proud.

           Linus