With GCC plugins enabled, external module builds can record
-fplugin=... paths in DWARF producer metadata via
-grecord-gcc-switches, leaking host/build specific paths and
triggering QA checks.

Handle this in scripts/Makefile.gcc-plugins for KBUILD_EXTMOD
builds by adding -gno-record-gcc-switches to plugin cflags.

This keeps plugin behavior unchanged while avoiding absolute
plugin path leakage in external module debug metadata.

Suggested-by: Nathan Chancellor <nathan@kernel.org>
Link: https://lore.kernel.org/all/20260817185146.GC1249844@ax162/
Signed-off-by: Jaihind Yadav <jaihindy@qti.qualcomm.com>
---
 scripts/Makefile.gcc-plugins | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/Makefile.gcc-plugins b/scripts/Makefile.gcc-plugins
index b0e1423b09c2..9b9899580571 100644
--- a/scripts/Makefile.gcc-plugins
+++ b/scripts/Makefile.gcc-plugins
@@ -8,6 +8,10 @@ ifdef CONFIG_GCC_PLUGIN_LATENT_ENTROPY
 endif
 export DISABLE_LATENT_ENTROPY_PLUGIN
 
+# Disable recording GCC options in debug info when building external modules to
+# avoid leaking absolute host build paths
+gcc-plugin-cflags-$(if $(KBUILD_EXTMOD),y) += -gno-record-gcc-switches
+
 # All the plugin CFLAGS are collected here in case a build target needs to
 # filter them out of the KBUILD_CFLAGS.
 GCC_PLUGINS_CFLAGS := $(strip $(addprefix -fplugin=$(objtree)/scripts/gcc-plugins/, $(gcc-plugin-y)) $(gcc-plugin-cflags-y)) -DGCC_PLUGINS
-- 
2.43.0

On Thu, 20 Aug 2026 11:31:16 +0530, Jaihind Yadav wrote:
> scripts/gcc-plugins: suppress recorded GCC switches for extmod builds

Applied to

  https://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git kbuild-next-unstable

Thanks!

[1/1] scripts/gcc-plugins: suppress recorded GCC switches for extmod builds
      https://git.kernel.org/kbuild/c/51794b107d54b

Please look out for regression or issue reports or other follow up
comments, as they may result in the patch/series getting dropped or
reverted. Patches applied to an "unstable" branch are accepted pending
wider testing in -next and any post-commit review; they will generally
be moved to the main branch in a week if no issues are found.

Best regards,
-- 
Cheers,
Nathan

On Thu, Aug 20, 2026 at 11:31:16AM +0530, Jaihind Yadav wrote:
> With GCC plugins enabled, external module builds can record
> -fplugin=... paths in DWARF producer metadata via
> -grecord-gcc-switches, leaking host/build specific paths and
> triggering QA checks.
> 
> Handle this in scripts/Makefile.gcc-plugins for KBUILD_EXTMOD
> builds by adding -gno-record-gcc-switches to plugin cflags.
> 
> This keeps plugin behavior unchanged while avoiding absolute
> plugin path leakage in external module debug metadata.
> 
> Suggested-by: Nathan Chancellor <nathan@kernel.org>
> Link: https://lore.kernel.org/all/20260817185146.GC1249844@ax162/
> Signed-off-by: Jaihind Yadav <jaihindy@qti.qualcomm.com>

Acked-by: Kees Cook <kees@kernel.org>

I'm fine with this going via the kbuild tree. :)

-Kees

-- 
Kees Cook

On Thu, Aug 20, 2026 at 11:31:16AM +0530, Jaihind Yadav wrote:
> With GCC plugins enabled, external module builds can record
> -fplugin=... paths in DWARF producer metadata via
> -grecord-gcc-switches, leaking host/build specific paths and
> triggering QA checks.
> 
> Handle this in scripts/Makefile.gcc-plugins for KBUILD_EXTMOD
> builds by adding -gno-record-gcc-switches to plugin cflags.
> 
> This keeps plugin behavior unchanged while avoiding absolute
> plugin path leakage in external module debug metadata.

Maybe it makes sense to add a note on how to restore the original
behaviour for those who may want to have the gcc switches recorded in
debug data for external kmods ('make KCFLAGS=-grecord-gcc-switches').


-- 
Nicolas