linux-kernel - Re: [GIT PULL] hardening updates for v6.18-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202509291904.479E322AE9@keescook>
Date: Mon, 29 Sep 2025 19:06:23 -0700
From: Kees Cook <kees@...nel.org>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: linux-kernel@...r.kernel.org, Andy Shevchenko <andy@...nel.org>,
	Christopher Fore <csfore@...teo.net>,
	"Gustavo A. R. Silva" <gustavoars@...nel.org>,
	Junjie Cao <junjie.cao@...el.com>,
	Lad Prabhakar <prabhakar.mahadev-lad.rj@...renesas.com>,
	Linus Walleij <linus.walleij@...aro.org>,
	Nathan Chancellor <nathan@...nel.org>,
	Philipp Zabel <p.zabel@...gutronix.de>,
	Vegard Nossum <vegard.nossum@...cle.com>
Subject: Re: [GIT PULL] hardening updates for v6.18-rc1

On Mon, Sep 29, 2025 at 05:59:17PM -0700, Linus Torvalds wrote:
> On Mon, 29 Sept 2025 at 12:15, Kees Cook <kees@...nel.org> wrote:
> >
> > Please pull these hardening updates for v6.18-rc1. One notable addition
> > is the creation of the "transitional" keyword for kconfig so CONFIG
> > renaming can go more smoothly. This has been a long-standing deficiency,
> > and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will
> > soon have KCFI support), this came up again. The breadth of the diffstat
> > is mainly this renaming.
> 
> So I really like this addition conceptually, but it doesn't actually
> seem to work.
> 
> My clang-building tree config had
> 
>     CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
>     # CONFIG_CFI_CLANG is not set
>     CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
> 
> but then when I pulled this and did a "make oldconfig" I get Kconfig asking me
> 
>     Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW)
> 
> anyway, in order to get
> 
>     CONFIG_ARCH_SUPPORTS_CFI=y
>     # CONFIG_CFI is not set
>     CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y
> 
> and I thought the whole point was that it would recognize the old
> Kconfig names and transition them to the new ones. And it very clearly
> does not.
> 
> So I'm a bit disappointed. Possibly because I expected the
> "transitional" keyword to be doing more than it does. But possibly
> because it's buggy and doesn't actually do what it is *supposed* to
> do.

Ah, the existing "=n" didn't persist. That's not expected. I will take
a look.

-- 
Kees Cook