From: Marco Elver Date: Mon, 12 Feb 2024 13:01:09 +0000 (+0100) Subject: hardening: Enable KFENCE in the hardening config X-Git-Tag: v6.9-rc1~164^2~31 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=de2683e7fdac0c33c4c2c115e69dbbbe904a2224;p=thirdparty%2Flinux.git hardening: Enable KFENCE in the hardening config KFENCE is not a security mitigation mechanism (due to sampling), but has the performance characteristics of unintrusive hardening techniques. When used at scale, however, it improves overall security by allowing kernel developers to detect heap memory-safety bugs cheaply. Link: https://lkml.kernel.org/r/79B9A832-B3DE-4229-9D87-748B2CFB7D12@kernel.org Cc: Matthieu Baerts Cc: Jakub Kicinski Signed-off-by: Marco Elver Link: https://lore.kernel.org/r/20240212130116.997627-1-elver@google.com Signed-off-by: Kees Cook --- diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config index ed126d7b5e83b..7a5bbfc024b7d 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -45,6 +45,9 @@ CONFIG_UBSAN_BOUNDS=y # CONFIG_UBSAN_ENUM # CONFIG_UBSAN_ALIGNMENT +# Sampling-based heap out-of-bounds and use-after-free detection. +CONFIG_KFENCE=y + # Linked list integrity checking. CONFIG_LIST_HARDENED=y