Commit a8f0b1f8 authored Jul 23, 2025 by Kees Cook

kstack_erase: Support Clang stack depth tracking

Wire up CONFIG_KSTACK_ERASE to Clang 21's new stack depth tracking
callback[1] option.

Link: https://clang.llvm.org/docs/SanitizerCoverage.html#tracing-stack-depth

 [1]
Acked-by: Nicolas Schier <n.schier@avm.de>
Link: https://lore.kernel.org/r/20250724055029.3623499-4-kees@kernel.org


Signed-off-by: Kees Cook <kees@kernel.org>

parent 6676fd3c

scripts/Makefile.kstack_erase

+6 −0

Original line number	Diff line number	Diff line
		@@ -8,6 +8,12 @@ kstack-erase-cflags-$(CONFIG_GCC_PLUGIN_STACKLEAK_VERBOSE) += -fplugin-arg-stack
		DISABLE_KSTACK_ERASE := -fplugin-arg-stackleak_plugin-disable
		endif

		ifdef CONFIG_CC_IS_CLANG
		kstack-erase-cflags-y += -fsanitize-coverage=stack-depth
		kstack-erase-cflags-y += -fsanitize-coverage-stack-depth-callback-min=$(CONFIG_KSTACK_ERASE_TRACK_MIN_SIZE)
		DISABLE_KSTACK_ERASE := -fno-sanitize-coverage=stack-depth
		endif

		KSTACK_ERASE_CFLAGS := $(kstack-erase-cflags-y)

		export STACKLEAK_CFLAGS DISABLE_KSTACK_ERASE

security/Kconfig.hardening

+4 −1

Original line number	Diff line number	Diff line
		@@ -82,10 +82,13 @@ choice

		endchoice

		config CC_HAS_SANCOV_STACK_DEPTH_CALLBACK
		def_bool $(cc-option,-fsanitize-coverage-stack-depth-callback-min=1)

		config KSTACK_ERASE
		bool "Poison kernel stack before returning from syscalls"
		depends on HAVE_ARCH_KSTACK_ERASE
		depends on GCC_PLUGINS
		depends on GCC_PLUGINS \|\| CC_HAS_SANCOV_STACK_DEPTH_CALLBACK
		help
		This option makes the kernel erase the kernel stack before
		returning from system calls. This has the effect of leaving