diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2026-06-15 05:01:15 +0530 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2026-06-15 05:01:15 +0530 |
| commit | 73f399414a84d715bb1794182aaea852b11d0962 (patch) | |
| tree | 91a7d6656d3d93dfb77a40c7b5763048ce9c61c1 /security | |
| parent | de02909ae81aa4fda213d16915adb5e1b088a7db (diff) | |
| parent | 1a1e62a5a48494cdf33e3bfb82fb8f408da7c4cc (diff) | |
Merge tag 'kbuild-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux
Pull Kbuild / Kconfig updates from Nathan Chancellor:
"Kbuild:
- Remove broken module linking exclusion for BTF
- Add documentation around how offset header files work
- Include unstripped vDSO libraries in pacman packages
- Bump minimum version of LLVM for building the kernel to 17.0.1 and
clean up unnecessary workarounds
- Use a context manager in run-clang-tools
- Add dist macro value if present to release tag for RPM packages
- Detect and report truncated buf_printf() output in modpost
- Add __llvm_covfun and __llvm_covmap to section whitelist in modpost
- Support Clang's distributed ThinLTO mode
- Remove architecture specific configurations for AutoFDO and
Propeller to ease individual architecture maintenance
Kconfig:
- Add kconfig-sym-check target to look for dangling Kconfig symbol
references and invalid tristate literal values
- Harden against potential NULL pointer dereference
- Fix typo in Kconfig test comment"
* tag 'kbuild-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (31 commits)
kconfig: tests: fix typo in comment
kconfig: Remove the architecture specific config for Propeller
kconfig: Remove the architecture specific config for AutoFDO
modpost: Add __llvm_covfun and __llvm_covmap to section_white_list
kconfig: add kconfig-sym-check static checker
kbuild: Remove unnecessary 'T' modifier in cmd_ar_builtin_fixup
kbuild: distributed build support for Clang ThinLTO
kbuild: move vmlinux.a build rule to scripts/Makefile.vmlinux_a
scripts: modpost: detect and report truncated buf_printf() output
kbuild: rpm-pkg: append %{?dist} macro to Release tag
run-clang-tools: run multiprocessing.Pool as context manager
compiler-clang.h: Drop explicit version number from "all" diagnostic macro
compiler-clang.h: Remove __cleanup -Wunused-variable workaround
kbuild: Remove check for broken scoping with clang < 17 in CC_HAS_ASM_GOTO_OUTPUT
x86/entry/vdso32: Remove conditional omission of '.cfi_offset eflags'
x86/module: Revert "Deal with GOT based stack cookie load on Clang < 17"
x86/build: Drop unnecessary '-ffreestanding' addition to KBUILD_CFLAGS
scripts/Makefile.warn: Drop -Wformat handling for clang < 16
riscv: Drop tautological condition from TOOLCHAIN_NEEDS_OLD_ISA_SPEC
riscv: Remove tautological condition from selection of ARCH_SUPPORTS_CFI
...
Diffstat (limited to 'security')
| -rw-r--r-- | security/Kconfig.hardening | 9 |
1 files changed, 1 insertions, 8 deletions
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index 86f8768c63d4..6923036e1a2f 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -188,10 +188,8 @@ config INIT_ON_FREE_DEFAULT_ON synthetic workloads have measured as high as 8%. config CC_HAS_ZERO_CALL_USED_REGS + # supported by gcc-11 or newer and all supported versions of clang def_bool $(cc-option,-fzero-call-used-regs=used-gpr) - # https://github.com/ClangBuiltLinux/linux/issues/1766 - # https://github.com/llvm/llvm-project/issues/59242 - depends on !CC_IS_CLANG || CLANG_VERSION > 150006 config ZERO_CALL_USED_REGS bool "Enable register zeroing on function exit" @@ -216,8 +214,6 @@ menu "Bounds checking" config FORTIFY_SOURCE bool "Harden common str/mem functions against buffer overflows" depends on ARCH_HAS_FORTIFY_SOURCE - # https://github.com/llvm/llvm-project/issues/53645 - depends on !X86_32 || !CC_IS_CLANG || CLANG_VERSION >= 160000 help Detect overflows of buffers in common string and memory functions where the compiler can determine and validate the buffer sizes. @@ -279,9 +275,6 @@ endmenu config CC_HAS_RANDSTRUCT def_bool $(cc-option,-frandomize-layout-seed-file=/dev/null) - # Randstruct was first added in Clang 15, but it isn't safe to use until - # Clang 16 due to https://github.com/llvm/llvm-project/issues/60349 - depends on !CC_IS_CLANG || CLANG_VERSION >= 160000 choice prompt "Randomize layout of sensitive kernel structures" |
