From nobody Tue Jul 14 14:56:09 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h02SB0gv9z6kqTx for ; Tue, 14 Jul 2026 14:56:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h02S96lFbz3Lfm for ; Tue, 14 Jul 2026 14:56:09 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040969; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dz2joyREsNNzBihtCTtZDlZXVgNGNlHvhOEB0tzfyxk=; b=c7griOW4WWsAgmWj2FLrw44wXJLVJBu4QJiMK4nAoYfnrSRTVga+LAVneTmNUmmujEnL2V KMbHQXSnYXQB9s1MjxFX3hACBY5JvuoLdOe+flS8FsGJ5fHFifA5MR03CMuN5A222TuHh/ 0UUWx6GkFFf3aUG/4PDc3mEehU63ZYzDegz3UgU2/mSEXcshElbmtiRn7P5sN05f0HlwMJ T+q2hU2fMt2nSGjrR7gjI9qYPj8/XSo3QXtT4qjq6qa4yBykw13+QtzFGO1D7Fdrw6vktF PeZqJI8X9vd/fVCWUa5rPVCtlc9+YRfqwe0bMAW4N/0z5jqKoHxfJyXXNX37gg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784040970; a=rsa-sha256; cv=none; b=VWSL+dRO+coZ18SsIR/M8PtPcgXZ5BqzC2VW+ktFHrZ6t7Ls2IW3q6OWcTn343TT/swn2n lnt1nY2bMrHXoHiDp6wgAJN+5IFx5G/IcZyRG78XlbZKKtgqfrgH1hE5LQW3MrhWx7E54f pqSNjmX4lSwaJfsYTldU2jQJL/3YKJt9w1/53vNttqfe9wYnUnFhhiNOwyuJZ+2VJoYmg5 c6dBraPYDiZyeE7U0N7lJk3El6OMrU6z737nc0M/AwQRHVCpSUKbdSZ+nJsDZJT6SqP+yh jV9s9/cIRyzdCjHdy9v1mCdh7QP0+SLiqBgNNRigs2xPCd3VvfY/Yy+do+bFXA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040969; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dz2joyREsNNzBihtCTtZDlZXVgNGNlHvhOEB0tzfyxk=; b=F+IlRjeWYBZzIx7bscujFIQMnaKPM+1iSzDCNxyrDPQHTDJISpbx1pfydNBvRqSe0t1vJR GKk/MEUO8iTDOfZVPMAfz1iCrQnZS5UX5afY7QzxWLIb9aVtim0cExfJ/UGmJMgZ3J7UAF 9E0KMJ1nlcog/q31goOjqHNkp1nNCF8O5BFGcjoCupOZVNyhQT6MWrU6mXrlyfA6PmA1lo l7KNE4A+squJMLxM6IyYJAErmlNEEqSXCZrr3bU74e/ZW9OjIwtXLUZiV6BUL3p1Qf/en6 cjAZHE0mSrXKxTDpyNk6YCrMKYL51JKsi6rHB47fzRZ1DZw2etP3EMe0+kdp4g== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h02S95lclzqRN for ; Tue, 14 Jul 2026 14:56:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3dad6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 14 Jul 2026 14:56:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 4542cc1d14bf - stable/14 - kernel: Enable -fstack-protector-strong by default List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 Auto-Submitted: auto-generated Date: Tue, 14 Jul 2026 14:56:09 +0000 Message-Id: <6a564e09.3dad6.cd8a76e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 commit 4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 Author: Mark Johnston AuthorDate: 2026-05-22 14:45:52 +0000 Commit: Mark Johnston CommitDate: 2026-07-14 13:02:07 +0000 kernel: Enable -fstack-protector-strong by default This extends stack canary use to all functions which define arrays on the stack, not just those which operate on byte buffers. This option would have made it harder to exploit SA-26:18.setcred and SA-26:08.rpcsec_gss. The change bloats the amd64 kernel text by about 350KB and increases the number of covered functions from ~1500 to ~9000 (within the kernel itself, i.e., not counting kernel modules). Reviewed by: olce, olivier, emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D56870 (cherry picked from commit 8deebce931fa9b469cf28a082038a64caf972602) --- sys/conf/kern.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk index f0c35bdeaa1f..daa637f038eb 100644 --- a/sys/conf/kern.mk +++ b/sys/conf/kern.mk @@ -234,7 +234,7 @@ CFLAGS+= -fwrapv # Stack Smashing Protection (SSP) support # .if ${MK_SSP} != "no" -CFLAGS+= -fstack-protector +CFLAGS+= -fstack-protector-strong .endif #