|
Jiri Slaby |
1adb2d |
From: Eric Biggers <ebiggers@google.com>
|
|
Jiri Slaby |
1adb2d |
Date: Tue, 7 Feb 2023 22:51:33 -0800
|
|
Jiri Slaby |
1adb2d |
Subject: [PATCH] randstruct: disable Clang 15 support
|
|
Jiri Slaby |
1adb2d |
References: bsc#1012628
|
|
Jiri Slaby |
1adb2d |
Patch-mainline: 6.2.1
|
|
Jiri Slaby |
1adb2d |
Git-commit: 78f7a3fd6dc66cb788c21d7705977ed13c879351
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
commit 78f7a3fd6dc66cb788c21d7705977ed13c879351 upstream.
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
The randstruct support released in Clang 15 is unsafe to use due to a
|
|
Jiri Slaby |
1adb2d |
bug that can cause miscompilations: "-frandomize-layout-seed
|
|
Jiri Slaby |
1adb2d |
inconsistently randomizes all-function-pointers structs"
|
|
Jiri Slaby |
1adb2d |
(https://github.com/llvm/llvm-project/issues/60349). It has been fixed
|
|
Jiri Slaby |
1adb2d |
on the Clang 16 release branch, so add a Clang version check.
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
Fixes: 035f7f87b729 ("randstruct: Enable Clang support")
|
|
Jiri Slaby |
1adb2d |
Cc: stable@vger.kernel.org
|
|
Jiri Slaby |
1adb2d |
Signed-off-by: Eric Biggers <ebiggers@google.com>
|
|
Jiri Slaby |
1adb2d |
Acked-by: Nick Desaulniers <ndesaulniers@google.com>
|
|
Jiri Slaby |
1adb2d |
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
|
|
Jiri Slaby |
1adb2d |
Reviewed-by: Bill Wendling <morbo@google.com>
|
|
Jiri Slaby |
1adb2d |
Signed-off-by: Kees Cook <keescook@chromium.org>
|
|
Jiri Slaby |
1adb2d |
Link: https://lore.kernel.org/r/20230208065133.220589-1-ebiggers@kernel.org
|
|
Jiri Slaby |
1adb2d |
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
Jiri Slaby |
1adb2d |
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
|
|
Jiri Slaby |
1adb2d |
---
|
|
Jiri Slaby |
1adb2d |
security/Kconfig.hardening | 3 +++
|
|
Jiri Slaby |
1adb2d |
1 file changed, 3 insertions(+)
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
|
|
Jiri Slaby |
1adb2d |
index 53baa95c..0f295961 100644
|
|
Jiri Slaby |
1adb2d |
--- a/security/Kconfig.hardening
|
|
Jiri Slaby |
1adb2d |
+++ b/security/Kconfig.hardening
|
|
Jiri Slaby |
1adb2d |
@@ -281,6 +281,9 @@ endmenu
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
config CC_HAS_RANDSTRUCT
|
|
Jiri Slaby |
1adb2d |
def_bool $(cc-option,-frandomize-layout-seed-file=/dev/null)
|
|
Jiri Slaby |
1adb2d |
+ # Randstruct was first added in Clang 15, but it isn't safe to use until
|
|
Jiri Slaby |
1adb2d |
+ # Clang 16 due to https://github.com/llvm/llvm-project/issues/60349
|
|
Jiri Slaby |
1adb2d |
+ depends on !CC_IS_CLANG || CLANG_VERSION >= 160000
|
|
Jiri Slaby |
1adb2d |
|
|
Jiri Slaby |
1adb2d |
choice
|
|
Jiri Slaby |
1adb2d |
prompt "Randomize layout of sensitive kernel structures"
|
|
Jiri Slaby |
1adb2d |
--
|
|
Jiri Slaby |
1adb2d |
2.35.3
|
|
Jiri Slaby |
1adb2d |
|