Date: Tue, 14 Jul 2026 14:56:09 +0000 From: Mark Johnston <markj@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org Subject: git: 4542cc1d14bf - stable/14 - kernel: Enable -fstack-protector-strong by default Message-ID: <6a564e09.3dad6.cd8a76e@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 commit 4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 Author: Mark Johnston <markj@FreeBSD.org> AuthorDate: 2026-05-22 14:45:52 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2026-07-14 13:02:07 +0000 kernel: Enable -fstack-protector-strong by default This extends stack canary use to all functions which define arrays on the stack, not just those which operate on byte buffers. This option would have made it harder to exploit SA-26:18.setcred and SA-26:08.rpcsec_gss. The change bloats the amd64 kernel text by about 350KB and increases the number of covered functions from ~1500 to ~9000 (within the kernel itself, i.e., not counting kernel modules). Reviewed by: olce, olivier, emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D56870 (cherry picked from commit 8deebce931fa9b469cf28a082038a64caf972602) --- sys/conf/kern.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk index f0c35bdeaa1f..daa637f038eb 100644 --- a/sys/conf/kern.mk +++ b/sys/conf/kern.mk @@ -234,7 +234,7 @@ CFLAGS+= -fwrapv # Stack Smashing Protection (SSP) support # .if ${MK_SSP} != "no" -CFLAGS+= -fstack-protector +CFLAGS+= -fstack-protector-strong .endif #home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a564e09.3dad6.cd8a76e>