From: Mark Rutland <mark.rutland@arm.com>
To: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
Kees Cook <keescook@chromium.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>,
Andrew Morton <akpm@linux-foundation.org>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH 2/6] efi: Avoid fortify checks in EFI stub
Date: Tue, 6 Jun 2017 18:17:12 +0100 [thread overview]
Message-ID: <20170606171712.GA4483@leverpostej> (raw)
In-Reply-To: <CAKv+Gu_nDZ2yfAQ+CHK3XXiTMp-A0CcFtCaJzErrZDWqbt0AOw@mail.gmail.com>
On Tue, Jun 06, 2017 at 05:13:07PM +0000, Ard Biesheuvel wrote:
> (+ Mark, Matt)
>
> On 6 June 2017 at 04:52, Kees Cook <keescook@chromium.org> wrote:
> > This avoids CONFIG_FORTIFY_SOURCE from being enabled during the EFI stub
> > build, as adding a panic() implementation may not work well. This can be
> > adjusted in the future.
> >
> > Suggested-by: Daniel Micay <danielmicay@gmail.com>
> > Signed-off-by: Kees Cook <keescook@chromium.org>
> > Cc; Matt Fleming <matt@codeblueprint.co.uk>
> > Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
I believe for arm64 the immediate breakage is implicitly fixed by the
<asm/string.h> definition, but I agree it makes sense to be explicit
anyhow.
FWIW:
Acked-by: Mark Rutland <mark.rutland@arm.com>
Kees, as an aside, do you want me to patchify the vdso fixup? Or are
you going to handle that?
Thanks,
Mark.
> > ---
> > drivers/firmware/efi/libstub/Makefile | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/drivers/firmware/efi/libstub/Makefile b/drivers/firmware/efi/libstub/Makefile
> > index f7425960f6a5..37e24f525162 100644
> > --- a/drivers/firmware/efi/libstub/Makefile
> > +++ b/drivers/firmware/efi/libstub/Makefile
> > @@ -17,6 +17,7 @@ cflags-$(CONFIG_ARM) := $(subst -pg,,$(KBUILD_CFLAGS)) \
> > cflags-$(CONFIG_EFI_ARMSTUB) += -I$(srctree)/scripts/dtc/libfdt
> >
> > KBUILD_CFLAGS := $(cflags-y) -DDISABLE_BRANCH_PROFILING \
> > + -D__NO_FORTIFY \
> > $(call cc-option,-ffreestanding) \
> > $(call cc-option,-fno-stack-protector)
> >
>
> Reviewed-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
>
> This is unlikely to conflict with anything going through the EFI tree,
> so feel free to queue it elsewhere.
next prev parent reply other threads:[~2017-06-06 17:18 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-06-06 4:52 [PATCH] FORTIFY_SOURCE build fixes Kees Cook
2017-06-06 4:52 ` [PATCH 1/6] arm64, vdso: Define vdso_{start,end} as array Kees Cook
2017-06-06 9:43 ` Catalin Marinas
2017-06-06 9:49 ` Will Deacon
2017-06-06 16:11 ` Kees Cook
2017-06-06 4:52 ` [PATCH 2/6] efi: Avoid fortify checks in EFI stub Kees Cook
2017-06-06 17:13 ` Ard Biesheuvel
2017-06-06 17:17 ` Mark Rutland [this message]
2017-06-07 3:12 ` Kees Cook
2017-06-07 8:54 ` Ard Biesheuvel
2017-06-08 2:37 ` Kees Cook
2017-06-09 9:01 ` Ard Biesheuvel
2017-06-16 9:14 ` Ard Biesheuvel
2017-06-07 9:27 ` Mark Rutland
2017-06-06 4:52 ` [PATCH 3/6] x86/power/64: Use char arrays for asm function names Kees Cook
2017-06-06 4:52 ` [PATCH 4/6] kexec_file: Adjust declaration of kexec_purgatory Kees Cook
2017-06-06 4:52 ` [PATCH 5/6] staging/rts5208: Fix read overflow in memcpy Kees Cook
2017-06-06 4:52 ` [PATCH 6/6] IB/rxe: Do not copy extra stack memory to skb Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170606171712.GA4483@leverpostej \
--to=mark.rutland@arm.com \
--cc=akpm@linux-foundation.org \
--cc=ard.biesheuvel@linaro.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
--cc=matt@codeblueprint.co.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.