diff mbox series

[55/62] make.sh: Enable -fstack-clash-protection for x86_64/aarch64

Message ID 20200816102953.3881-55-michael.tremer@ipfire.org
State Accepted
Commit 87f3b1e5682dbf13c9e2203ade95b55cbc91c626
Headers
Series [01/62] bison: Update to 3.7.1 |

Commit Message

Michael Tremer Aug. 16, 2020, 10:29 a.m. UTC 
  This patch turns on instrumentation to avoid skipping the guard page
in large stack frames.

Without this flag, vulnerabilities can result in where the stack
overlaps with the heap, or thread stacks spill into other regions
of memory.

This flag in only available on x86_64 and aarch64.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
---
 make.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/make.sh b/make.sh
index 0f3917adf..fae75fdc9 100755
--- a/make.sh
+++ b/make.sh
@@ -146,7 +146,7 @@  configure_build() {
 			BUILDTARGET="${build_arch}-unknown-linux-gnu"
 			CROSSTARGET="${build_arch}-cross-linux-gnu"
 			BUILD_PLATFORM="x86"
-			CFLAGS_ARCH="-m64 -mtune=generic"
+			CFLAGS_ARCH="-m64 -mtune=generic -fstack-clash-protection"
 			;;
 
 		i586)
@@ -160,7 +160,7 @@  configure_build() {
 			BUILDTARGET="${build_arch}-unknown-linux-gnu"
 			CROSSTARGET="${build_arch}-cross-linux-gnu"
 			BUILD_PLATFORM="arm"
-			CFLAGS_ARCH=""
+			CFLAGS_ARCH="-fstack-clash-protection"
 			;;
 
 		armv7hl)