From nobody Tue Jul 14 14:56:09 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4h02SB4zx7z6kqZw for ; Tue, 14 Jul 2026 14:56:10 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4h02SB0CDJz3M7K for ; Tue, 14 Jul 2026 14:56:10 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040970; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dz2joyREsNNzBihtCTtZDlZXVgNGNlHvhOEB0tzfyxk=; b=rK+a0IU7WdD7kzxJ/5kkRLZo+EJGMlw6Iy0Gqs2hw+f+43eOoHPv8rqHUqmBji3lISEkg+ AmlwpFQ5Um8BEJ5xlZKKoLcOk3GDrw80tiPFeTgFx+wOsBu7H8bqa8RxrTs/Crvh4QPQfC AYH5e5NnTcQfWqo7qmwH7OGE9E+uA5FaFKqs0mxxYWNq2wcZQQnH3ggLXLsRk3PpIB2l3U glMCwmgew6oe1XETZvbbcfHhV9i2jj2A/2zkQTyLIxVDtbLjcaCBg5NT8UuIajaP1s741Q ILvt1ahiuduIeOg8UT4Nw0EpBu/AKz74zKhC7b2l4WzmoRrs+O2P+ko1CaYO1g== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1784040970; a=rsa-sha256; cv=none; b=oO7wRg0N2Eh2JqQBxLMLXBWcp5j42be66gnuIwe/pMivdHj03yBjPyyIMqtOjsm7uM4RSl uB+/83M35y/D7QIwboMW1ika4Svfclk2HcSTt1cgRzP6gwBv8SXM5rj7QGsZ1D1OHvaeRm h1/kN77/+ZykkUGFlnuR1PLuPtPHGP/5o0wsXU7TrIJ0ATeN0x7XBhWqj5nyFwdCn7smig q712DClMV6hMdw2sFLGj0CuBJjJ+10w9JK1yv2RNMGthL4saP38HRA8Ayv5mSJe5xGgEVt Nz571X+2TcEO09ItGaXC9oXiM+lYne3AEUNIaMqFjmAEDmiLQuhS9n8qXDALVA== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1784040970; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=Dz2joyREsNNzBihtCTtZDlZXVgNGNlHvhOEB0tzfyxk=; b=CAnCsCWOFP1W6YfANzGC++pyZg03bxvMudneFwjggfXK8Wch2wzfDum6Dxi5LaCGzvjM5R 1KmfG7YgdL3hCH+F/xsq+qPi1rLG6L5N7XLjSCQP1hcK4tRm23DxqyORP5P/7G4Kf0IGNh Q5mwoKH+nPBuxGcV+7lcqq6QTp6mTZaD4XQ7EZF3D98qw/T616CuOPFN3yN+GoTiOwZtSM StjgXdA7cZzBK5PSGDoEfmfLYxlcXKIspwp9KVV2jmO6gw8/r04HAXBAsCkiDye5fYomPe UZarow/iBcjsUoGkfEf73aeElVlHLAbtpwbQdwi7GGpZMDzAyjEPw8WRpOzmoA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4h02S95lXyzqRM for ; Tue, 14 Jul 2026 14:56:09 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3dad6 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Tue, 14 Jul 2026 14:56:09 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Mark Johnston Subject: git: 4542cc1d14bf - stable/14 - kernel: Enable -fstack-protector-strong by default List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: markj X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 Auto-Submitted: auto-generated Date: Tue, 14 Jul 2026 14:56:09 +0000 Message-Id: <6a564e09.3dad6.cd8a76e@gitrepo.freebsd.org> The branch stable/14 has been updated by markj: URL: https://cgit.FreeBSD.org/src/commit/?id=4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 commit 4542cc1d14bfa965c51093b1f1aa5d5ce11be3e0 Author: Mark Johnston AuthorDate: 2026-05-22 14:45:52 +0000 Commit: Mark Johnston CommitDate: 2026-07-14 13:02:07 +0000 kernel: Enable -fstack-protector-strong by default This extends stack canary use to all functions which define arrays on the stack, not just those which operate on byte buffers. This option would have made it harder to exploit SA-26:18.setcred and SA-26:08.rpcsec_gss. The change bloats the amd64 kernel text by about 350KB and increases the number of covered functions from ~1500 to ~9000 (within the kernel itself, i.e., not counting kernel modules). Reviewed by: olce, olivier, emaste MFC after: 2 weeks Differential Revision: https://reviews.freebsd.org/D56870 (cherry picked from commit 8deebce931fa9b469cf28a082038a64caf972602) --- sys/conf/kern.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/conf/kern.mk b/sys/conf/kern.mk index f0c35bdeaa1f..daa637f038eb 100644 --- a/sys/conf/kern.mk +++ b/sys/conf/kern.mk @@ -234,7 +234,7 @@ CFLAGS+= -fwrapv # Stack Smashing Protection (SSP) support # .if ${MK_SSP} != "no" -CFLAGS+= -fstack-protector +CFLAGS+= -fstack-protector-strong .endif #