+++ /dev/null
-From stable-bounces@linux.kernel.org Mon Feb 18 16:05:47 2008
-From: Sam Ravnborg <sam@ravnborg.org>
-Date: Tue, 19 Feb 2008 00:05:28 GMT
-Subject: kbuild: allow -fstack-protector to take effect
-To: jejb@kernel.org, stable@kernel.org
-Message-ID: <200802190005.m1J05SKP017015@hera.kernel.org>
-
-From: Sam Ravnborg <sam@ravnborg.org>
-
-commit: e06b8b98da071f7dd78fb7822991694288047df0
-
-Arjan van de Ven <arjan@infradead.org> wrote:
-===
-I just read the excellent LWN writeup of the vmsplice
-security thing, and that got me wondering why this attack
-wasn't stopped by the CONFIG_CC_STACKPROTECTOR option...
-because it plain should have been...
-
-Some analysis later.. it turns out that the following line
-in the top level Makefile, added by you in October 2007,
-entirely disables CONFIG_CC_STACKPROTECTOR ;(
-With this line removed the exploit will be nicely stopped.
-
-CFLAGS += $(call cc-option, -fno-stack-protector)
-
-Now I realize that certain distros have patched gcc to
-compensate for their lack of distro wide CFLAGS, and it's
-great to work around that... but would there be a way to NOT
-disable this for CONFIG_CC_STACKPROTECTOR please?
-It would have made this exploit not possible for those kernels
-that enable this feature (and that includes distros like Fedora)
-===
-
-Move the assignment to KBUILD_CFLAGS up before including
-the arch specific Makefile so arch makefiles may override
-the setting.
-
-Signed-off-by: Sam Ravnborg <sam@ravnborg.org>
-Cc: Arjan van de Ven <arjan@infradead.org>
-Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-
----
- Makefile | 7 ++++---
- 1 file changed, 4 insertions(+), 3 deletions(-)
-
---- a/Makefile
-+++ b/Makefile
-@@ -507,6 +507,10 @@ else
- KBUILD_CFLAGS += -O2
- endif
-
-+# Force gcc to behave correct even for buggy distributions
-+# Arch Makefiles may override this setting
-+KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
-+
- include $(srctree)/arch/$(SRCARCH)/Makefile
-
- ifdef CONFIG_FRAME_POINTER
-@@ -520,9 +524,6 @@ KBUILD_CFLAGS += -g
- KBUILD_AFLAGS += -gdwarf-2
- endif
-
--# Force gcc to behave correct even for buggy distributions
--KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
--
- # arch Makefile may override CC so keep this after arch Makefile is included
- NOSTDINC_FLAGS += -nostdinc -isystem $(shell $(CC) -print-file-name=include)
- CHECKFLAGS += $(NOSTDINC_FLAGS)