From nobody Wed Feb 11 07:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B2992144C9; Thu, 1 May 2025 19:48:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; cv=none; b=gNDfAcV72mcenUc/Y6DWed1AUwkoCsxkqm4AL1Cx2xkaUvn+JFGuCE/d8tQcHbcWwnbAcZvRHmEzUY2fo0a+VZKMbATMzJJUcJqUx5Q8Qnc3t162AiD3J/cOqVkB3LJnKsq/cAITbLw8s9kk0HBgaQ31wpgLFxuUmGU2wRFzr60= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; c=relaxed/simple; bh=nJ/O2qfc5y7+GRelzxRyWAg1TE/6pK01eAAImGz7s0o=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=MPBMVH/D+qagrxrMK/q1zIp9DBL/CzGt3PaGsQ0mmcRrjmE7D/egoT6J64y/sx5iQ4Wvf2JuXh95S5dBG90EUtsNcAL5dK2tFNG/TMKBerOUSm+ZFgMAA6ZDFbLhgRMcdSw8e7MKcJErxWMw8dndeeW9tO8du4RKe6vaxKTJc8E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=k6XGbZ49; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="k6XGbZ49" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1AACFC4AF0B; Thu, 1 May 2025 19:48:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1746128909; bh=nJ/O2qfc5y7+GRelzxRyWAg1TE/6pK01eAAImGz7s0o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k6XGbZ49vl8PTh+LQjcJFY0SfyaNPpsIRb8XsMKZKxWg6Xeoin0vF22/pdsR/WOqY rtGYgoCR4cfYfGrDgrLlzcbZl6THWvE6FE/iuAgGwi/gMgysDcd/0wF8cGQ5/EB6D9 3b8mHsDzhEs90sHxQ9wx2tNtFaxJ8j4sbYBIY/8j9mrhkHcXEuM/DdPxEiuu/HWtZ5 QitPXN64n24J7PauE+1Oql2iTEZ9kcuZovpM5sX3CEQ1PcBm0GUSTe8DqTv/HlwEYu 5rztIYEAL1cJ95qTMQ8uEEwb9iwFvGkThlFcYktOfXx0Fx5fHQvBD78u84n+0CoL6G bbqGjaaZkpa9A== From: Kees Cook To: Masahiro Yamada Cc: Kees Cook , Nathan Chancellor , Nicolas Schier , linux-hardening@vger.kernel.org, linux-kbuild@vger.kernel.org, Petr Pavlu , Sebastian Andrzej Siewior , Justin Stitt , Marco Elver , Andrey Konovalov , Andrey Ryabinin , linux-kernel@vger.kernel.org, kasan-dev@googlegroups.com Subject: [PATCH 1/3] gcc-plugins: Force full rebuild when plugins change Date: Thu, 1 May 2025 12:48:16 -0700 Message-Id: <20250501194826.2947101-1-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250501193839.work.525-kees@kernel.org> References: <20250501193839.work.525-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=1929; i=kees@kernel.org; h=from:subject; bh=nJ/O2qfc5y7+GRelzxRyWAg1TE/6pK01eAAImGz7s0o=; b=owGbwMvMwCVmps19z/KJym7G02pJDBnCFxh7neu0XGZnlWzRUTPY0/hmqavW0X8s8ZvqWDaLM YtfZWDpKGVhEONikBVTZAmyc49z8XjbHu4+VxFmDisTyBAGLk4BmIixGsP/0Jsy0+XCkiRaDyZ8 a3qewybydodJZSCjU7gao1DsHN1sRobLb+7dut0Q9Cbs45z/D6p6V370npSh9UJGkSmOZXWL1E4 WAA== X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" There was no dependency between the plugins changing and the rest of the kernel being built. Enforce this by including a synthetic header file when using plugins, that is regenerated any time the plugins are built. Signed-off-by: Kees Cook --- Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Nicolas Schier Cc: Cc: --- scripts/Makefile.gcc-plugins | 2 +- scripts/gcc-plugins/Makefile | 8 ++++++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins index 5b8a8378ca8a..b0d2b9ccf42c 100644 --- a/scripts/Makefile.gcc-plugins +++ b/scripts/Makefile.gcc-plugins @@ -38,7 +38,7 @@ export DISABLE_STACKLEAK_PLUGIN =20 # All the plugin CFLAGS are collected here in case a build target needs to # filter them out of the KBUILD_CFLAGS. -GCC_PLUGINS_CFLAGS :=3D $(strip $(addprefix -fplugin=3D$(objtree)/scripts/= gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y)) +GCC_PLUGINS_CFLAGS :=3D $(strip $(addprefix -fplugin=3D$(objtree)/scripts/= gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y)) -include $(objtree)/= scripts/gcc-plugins/deps.h export GCC_PLUGINS_CFLAGS =20 # Add the flags to the build! diff --git a/scripts/gcc-plugins/Makefile b/scripts/gcc-plugins/Makefile index 320afd3cf8e8..38fd4c9f9b98 100644 --- a/scripts/gcc-plugins/Makefile +++ b/scripts/gcc-plugins/Makefile @@ -66,3 +66,11 @@ quiet_cmd_plugin_cxx_o_c =3D HOSTCXX $@ =20 $(plugin-objs): $(obj)/%.o: $(src)/%.c FORCE $(call if_changed_dep,plugin_cxx_o_c) + +quiet_cmd_gcc_plugins_updated =3D UPDATE $@ + cmd_gcc_plugins_updated =3D echo '/* $^ */' > $(obj)/deps.h + +$(obj)/deps.h: $(plugin-single) $(plugin-multi) FORCE + $(call if_changed,gcc_plugins_updated) + +always-y +=3D deps.h --=20 2.34.1 From nobody Wed Feb 11 07:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B222201034; Thu, 1 May 2025 19:48:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; cv=none; b=jQqqvc30TqyuYStnOko1cynmxdpp1YCg84m4dlx4wLzAYIznsWTG2RM05nqkam7Vy6+SqlVQEHW8is9fsK76mdF7CRap6tV6ziSKyjD+O9t+suJ+GAAX8x7DDk7lvjqqPY1DgM4BZp4xe66rf9MOgsvYT0Gm+TkX4g+hAoaBZFI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; c=relaxed/simple; bh=8LFYhUOk2+Lg4KhiXXk+lmCuulr10jRLqqlaJXRzOrE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=aQtpivkxpd/Ia8SeBQqaFQ6EeFl6ISPNhzz5vhsIPndOHRj6aGi3ND1Sy8grntzG4/ZQYjyFEMWr/K74bnK97E9JEa8t/ozmJ+UUHay42p3TGrdlPQcPTknWH3N+oPYD5k/FiZG3opm8sc7narylkkOlK9MZw6N3KycsONUHp5Q= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OoaU0ply; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OoaU0ply" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1646DC4CEE3; Thu, 1 May 2025 19:48:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1746128909; bh=8LFYhUOk2+Lg4KhiXXk+lmCuulr10jRLqqlaJXRzOrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OoaU0ply0zZoLW19x2S5w/vOr9gMBxBZvZWYEy+zdy9ynwqc1RJ6slmlbpJHvXmUX UjDWsOVqy2jCTr0Gk5vsO4BshJuz7Xsd1gIjx5OzY55M5IVbvUOnQEj3XOvZl/6Ecj U2WdBTd4AewUdvU9M4k82Ia56Q8qokJ+IGBGK5DYrSBNuJyrP2N1PUZPfAZiEpcgZC MrL9OlrhBdR15+apQWo8S/nkoUOOHRtYAh9LVnK6Pp2hKkrIQqLtqDFAmcenq6MrZC LwRpTv7DYJYFtmXxgN1Z5Y7rd7Y+PP03GzBDUverxD73IZIv1bnMqzEs04HZz9pqzk ZT/6OI+kFC5CQ== From: Kees Cook To: Masahiro Yamada Cc: Kees Cook , Nathan Chancellor , Nicolas Schier , Petr Pavlu , Sebastian Andrzej Siewior , linux-kbuild@vger.kernel.org, Justin Stitt , Marco Elver , Andrey Konovalov , Andrey Ryabinin , linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, kasan-dev@googlegroups.com Subject: [PATCH 2/3] randstruct: Force full rebuild when seed changes Date: Thu, 1 May 2025 12:48:17 -0700 Message-Id: <20250501194826.2947101-2-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250501193839.work.525-kees@kernel.org> References: <20250501193839.work.525-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2614; i=kees@kernel.org; h=from:subject; bh=8LFYhUOk2+Lg4KhiXXk+lmCuulr10jRLqqlaJXRzOrE=; b=owGbwMvMwCVmps19z/KJym7G02pJDBnCFxilL1bpJjfMsursvPHsZVvOgY2/T2osYPuZcVu/O /PSkVNKHaUsDGJcDLJiiixBdu5xLh5v28Pd5yrCzGFlAhnCwMUpABN5cI/hf8CtpJVxv4zKS3pC 1uSt7nzgcupuV5KsK3NNik/hmpKEOYwMk75s22Rhal9opsopI2+uzPizQo7lAu8EFdad2Z2Pq83 YAQ== X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" While the randstruct GCC plugin was being rebuilt if the randstruct seed changed, Clangs build did not notice the change. Include the hash header directly so that it becomes a universal build dependency and full rebuilds will happen if it changes. Signed-off-by: Kees Cook --- Cc: Masahiro Yamada Cc: Nathan Chancellor Cc: Nicolas Schier Cc: Petr Pavlu Cc: Sebastian Andrzej Siewior Cc: --- include/linux/vermagic.h | 1 - scripts/Makefile.randstruct | 3 ++- scripts/basic/Makefile | 11 ++++++----- 3 files changed, 8 insertions(+), 7 deletions(-) diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h index 939ceabcaf06..335c360d4f9b 100644 --- a/include/linux/vermagic.h +++ b/include/linux/vermagic.h @@ -33,7 +33,6 @@ #define MODULE_VERMAGIC_MODVERSIONS "" #endif #ifdef RANDSTRUCT -#include #define MODULE_RANDSTRUCT "RANDSTRUCT_" RANDSTRUCT_HASHED_SEED #else #define MODULE_RANDSTRUCT diff --git a/scripts/Makefile.randstruct b/scripts/Makefile.randstruct index 24e283e89893..ab87219c6149 100644 --- a/scripts/Makefile.randstruct +++ b/scripts/Makefile.randstruct @@ -12,6 +12,7 @@ randstruct-cflags-y \ +=3D -frandomize-layout-seed-file=3D$(objtree)/scripts/basic/randstruct.s= eed endif =20 -export RANDSTRUCT_CFLAGS :=3D $(randstruct-cflags-y) +export RANDSTRUCT_CFLAGS :=3D $(randstruct-cflags-y) \ + -include $(objtree)/scripts/basic/randstruct_hash.h =20 KBUILD_CFLAGS +=3D $(RANDSTRUCT_CFLAGS) diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile index dd289a6725ac..31637ce4dc5c 100644 --- a/scripts/basic/Makefile +++ b/scripts/basic/Makefile @@ -8,9 +8,10 @@ hostprogs-always-y +=3D fixdep # before running a Clang kernel build. gen-randstruct-seed :=3D $(srctree)/scripts/gen-randstruct-seed.sh quiet_cmd_create_randstruct_seed =3D GENSEED $@ -cmd_create_randstruct_seed =3D \ - $(CONFIG_SHELL) $(gen-randstruct-seed) \ - $@ $(objtree)/include/generated/randstruct_hash.h -$(obj)/randstruct.seed: $(gen-randstruct-seed) FORCE + cmd_create_randstruct_seed =3D $(CONFIG_SHELL) $(gen-randstruct-seed= ) \ + $(obj)/randstruct.seed $(obj)/randstruct_hash.h + +$(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-randstruct-seed) FO= RCE $(call if_changed,create_randstruct_seed) -always-$(CONFIG_RANDSTRUCT) +=3D randstruct.seed + +always-$(CONFIG_RANDSTRUCT) +=3D randstruct.seed randstruct_hash.h --=20 2.34.1 From nobody Wed Feb 11 07:48:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9B2F721C183; Thu, 1 May 2025 19:48:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; cv=none; b=B0jb3JlBFPiOlM/VD+x72SzYbOjOaX07R5zuoi8gYCgjE+Tl5jmMJOr7zSCuD24BZhTIcRCmbhba4SQt46z8P4DxkGzynDQAW24IjYBOc9jXxSlC9FbvMTLo7QgIFUILmpqeSrTn1e+tC9KQfgcCoq1ONYqOKbhneNcC9+EDVD0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746128909; c=relaxed/simple; bh=EquXf22t1MG3qlvTmHUyGycZGdk2twt1J14XgIQ4XgY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=IsCyeAZxymGbD3WvTdNXMZGR/UnuEkUxPJ/Ie/cO+iYjBzn+BEgdl2LVXwDtmKFAe9zE1kuJ71t/9rYnWVhDp79EctZexCjBRNowGn+NSEQ8AW95khxW6qCjnI+oYGddnAk2XST52mnNker8JeRT/ER50fS0FhWgSUurNxE2KME= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=iEZ0cBDP; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="iEZ0cBDP" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D297C4AF0C; Thu, 1 May 2025 19:48:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1746128909; bh=EquXf22t1MG3qlvTmHUyGycZGdk2twt1J14XgIQ4XgY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iEZ0cBDPV30yaUNfww7jGrgei/ijNalpIuUG+CJCcxbQuOoOGDcEQIc/oDWAT1Il5 XJpo3iwq2Iq+CcCQZRQfVzWgwxb3lqDZJZi9tjwP1x3fF8sPpo/eAd6uFrtAIajMhS Akwn/sqpsq/foMuM5yfPfbhQMLwnfl7Yq4Z4OQofvnH1qkJYH32xUnn5QDyLNiUbaq EheXsWooLzvPhkm4BiYkw1QyMJsOqahVECr8aTA5h0sa+xWgSRnsJAWazs51mw+o2z 41nbI8sONxQAMXBLCNyazNZVoYDpMj+OmNADQDaYshHu27WdMrCyd1GatDWbMs32Nl kn+MdUxVEFDTg== From: Kees Cook To: Masahiro Yamada Cc: Kees Cook , Justin Stitt , Nathan Chancellor , Nicolas Schier , Marco Elver , Andrey Konovalov , Andrey Ryabinin , linux-kbuild@vger.kernel.org, kasan-dev@googlegroups.com, linux-hardening@vger.kernel.org, Petr Pavlu , Sebastian Andrzej Siewior , linux-kernel@vger.kernel.org Subject: [PATCH 3/3] integer-wrap: Force full rebuild when .scl file changes Date: Thu, 1 May 2025 12:48:18 -0700 Message-Id: <20250501194826.2947101-3-kees@kernel.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250501193839.work.525-kees@kernel.org> References: <20250501193839.work.525-kees@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2139; i=kees@kernel.org; h=from:subject; bh=EquXf22t1MG3qlvTmHUyGycZGdk2twt1J14XgIQ4XgY=; b=owGbwMvMwCVmps19z/KJym7G02pJDBnCFxhVw5LkMtT9F1052nPHuakx/wafkvXdLeWmT+V0x I5O0EvtKGVhEONikBVTZAmyc49z8XjbHu4+VxFmDisTyBAGLk4BmEiHOcP/+vxpzp/EF33dfr7I rHzutYapwnX5fJ9t70n23E33Oau8npHh19meOVfrLig1qc56t0x7ZcinFGPV3KJ/4i/eZy9VbJL hBgA= X-Developer-Key: i=kees@kernel.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Since the integer wrapping sanitizer's behavior depends on its associated .scl file, we must force a full rebuild if the file changes. Universally include a synthetic header file that is rebuilt when the .scl file changes. Signed-off-by: Kees Cook --- Cc: Masahiro Yamada Cc: Justin Stitt Cc: Nathan Chancellor Cc: Nicolas Schier Cc: Marco Elver Cc: Andrey Konovalov Cc: Andrey Ryabinin Cc: Cc: Cc: --- scripts/Makefile.ubsan | 1 + scripts/basic/Makefile | 9 +++++++++ 2 files changed, 10 insertions(+) diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan index 9e35198edbf0..254d5a7ec994 100644 --- a/scripts/Makefile.ubsan +++ b/scripts/Makefile.ubsan @@ -15,6 +15,7 @@ ubsan-cflags-$(CONFIG_UBSAN_TRAP) +=3D $(call cc-option,= -fsanitize-trap=3Dundefined export CFLAGS_UBSAN :=3D $(ubsan-cflags-y) =20 ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP) +=3D \ + -include $(objtree)/scripts/basic/integer-wrap.h \ -fsanitize-undefined-ignore-overflow-pattern=3Dall \ -fsanitize=3Dsigned-integer-overflow \ -fsanitize=3Dunsigned-integer-overflow \ diff --git a/scripts/basic/Makefile b/scripts/basic/Makefile index 31637ce4dc5c..04f5620a3f8b 100644 --- a/scripts/basic/Makefile +++ b/scripts/basic/Makefile @@ -15,3 +15,12 @@ $(obj)/randstruct_hash.h $(obj)/randstruct.seed: $(gen-r= andstruct-seed) FORCE $(call if_changed,create_randstruct_seed) =20 always-$(CONFIG_RANDSTRUCT) +=3D randstruct.seed randstruct_hash.h + +# integer-wrap: if the .scl file changes, we need to do a full rebuild. +quiet_cmd_integer_wrap_updated =3D UPDATE $@ + cmd_integer_wrap_updated =3D echo '/* $^ */' > $(obj)/integer-wrap.h + +$(obj)/integer-wrap.h: $(srctree)/scripts/integer-wrap-ignore.scl FORCE + $(call if_changed,integer_wrap_updated) + +always-$(CONFIG_UBSAN_INTEGER_WRAP) +=3D integer-wrap.h --=20 2.34.1