On Fri, Jun 26, 2020 at 1:21 PM Kees Cook <keescook@xxxxxxxxxxxx> wrote: > > On Fri, Jun 26, 2020 at 01:13:20PM -0700, Nick Desaulniers wrote: > > On Fri, Jun 26, 2020 at 12:00 PM Masahiro Yamada <masahiroy@xxxxxxxxxx> wrote: > > > > > > +++ b/Makefile > > > @@ -762,7 +762,7 @@ ifneq ($(CONFIG_FRAME_WARN),0) > > > KBUILD_CFLAGS += -Wframe-larger-than=$(CONFIG_FRAME_WARN) > > > endif > > > > > > -stackp-flags-$(CONFIG_CC_HAS_STACKPROTECTOR_NONE) := -fno-stack-protector > > > +stackp-flags-y := -fno-stack-protector > > > stackp-flags-$(CONFIG_STACKPROTECTOR) := -fstack-protector > > > stackp-flags-$(CONFIG_STACKPROTECTOR_STRONG) := -fstack-protector-strong > > > > So it looks like the previous behavior always added > > `-fno-stack-protector` (since CONFIG_CC_HAS_STACKPROTECTOR_NONE was > > always true), but then we append either `-fstack-protector` or > > `-fstack-protector-strong` based on configs. While that's ok, and you > > patch doesn't change that behavior, and it's good to be explicit to > > set the stack protector or not...it seems weird to have > > `-fno-stack-protector -fstack-protector` in the command line flags. I > > would prefer if we checked for not having CONFIG_STACKPROTECTOR or > > CONFIG_STACKPROTECTOR_STRONG before adding `-fno-stack-protector`. > > That doesn't have to be done in this patch, per se. > > No, it would add only what was latest and most selected. (They're all > ":=" assignments.) If CONFIG_STACKPROTECTOR_STRONG, only > -fstack-protector-strong is set. If only CONFIG_STACKPROTECTOR, only > -fstack-protector is set. Otherwise -fno-stack-protector. Ah, right. Thanks for pointing that out. I'm still curious if the CFLAGS_<file>.o rules get appended or overwrite all flags for that translation unit? -- Thanks, ~Nick Desaulniers
