diff mbox series

[1/3] Do not use -Wp to disable fortify (BZ 31928)

Message ID 20240910122244.1995107-2-adhemerval.zanella@linaro.org
State Committed
Commit 127cefd84dc551a43d0ac58b4619503d04869042
Delegated to: DJ Delorie
Headers
Series Allow glibc to build with gcc that defaults to fortify, LFS, and 64-bit time_t |

Checks

Context Check Description
redhat-pt-bot/TryBot-apply_patch success Patch applied to master at the time it was sent
linaro-tcwg-bot/tcwg_glibc_build--master-arm success Build passed
linaro-tcwg-bot/tcwg_glibc_build--master-aarch64 success Build passed
linaro-tcwg-bot/tcwg_glibc_check--master-arm success Test passed
linaro-tcwg-bot/tcwg_glibc_check--master-aarch64 success Test passed

Commit Message

Adhemerval Zanella Netto Sept. 10, 2024, 12:22 p.m. UTC 
  The -Wp does not work properly if the compiler is configured to enable
fortify by default, since it bypasses the compiler driver (which defines
the fortify flags in this case).

This patch is similar to the one used on Ubuntu [1].

I checked with a build for x86_64-linux-gnu, i686-linux-gnu,
aarch64-linux-gnu, s390x-linux-gnu, and riscv64-linux-gnu with
gcc-13 that enables the fortify by default.

Co-authored-by: Matthias Klose <matthias.klose@canonical.com>

[1] https://git.launchpad.net/~ubuntu-core-dev/ubuntu/+source/glibc/tree/debian/patches/ubuntu/fix-fortify-source.patch
---
 configure             |  4 ++--
 configure.ac          |  4 ++--
 debug/Makefile        | 19 ++++++++++---------
 io/Makefile           |  2 +-
 stdio-common/Makefile |  2 +-
 wcsmbs/Makefile       |  2 +-
 6 files changed, 17 insertions(+), 16 deletions(-)

Comments

DJ Delorie Sept. 23, 2024, 10:11 p.m. UTC | #1 
LGTM.
Reviewed-by: DJ Delorie <dj@redhat.com>

Adhemerval Zanella <adhemerval.zanella@linaro.org> writes:
> diff --git a/configure.ac b/configure.ac
> -no_fortify_source="-Wp,-U_FORTIFY_SOURCE"
> +no_fortify_source="-U_FORTIFY_SOURCE"


>  AS_IF([test "$libc_cv_fortify_source" = yes],
> -      [fortify_source="${fortify_source},-D_FORTIFY_SOURCE=${enable_fortify_source}"]
> +      [fortify_source="${fortify_source} -D_FORTIFY_SOURCE=${enable_fortify_source}"]
>        )

So we're only effectively removing the -Wp, part and passing the -D/-U
to whatever compiler pass cares.  Ok.

> diff --git a/debug/Makefile b/debug/Makefile

>  CFLAGS-tst-longjmp_chk.c += -fexceptions -fasynchronous-unwind-tables
> -CPPFLAGS-tst-longjmp_chk.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-longjmp_chk.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
>  CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
> -CPPFLAGS-tst-longjmp_chk2.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-longjmp_chk2.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
>  CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
> -CPPFLAGS-tst-longjmp_chk3.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
> -CPPFLAGS-tst-realpath-chk.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> -CPPFLAGS-tst-chk-cancel.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> -CFLAGS-tst-sprintf-fortify-rdonly.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> -CFLAGS-tst-fortify-syslog.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> -CFLAGS-tst-fortify-wide.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> +CPPFLAGS-tst-longjmp_chk3.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
> +CPPFLAGS-tst-realpath-chk.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
> +CPPFLAGS-tst-chk-cancel.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
> +CFLAGS-tst-sprintf-fortify-rdonly.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
> +CFLAGS-tst-fortify-syslog.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
> +CFLAGS-tst-fortify-wide.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2

OK, just taking them out of the -Wp, context.

> -CFLAGS-tst-fortify-$(1)-$(2)-$(3)-$(4).$(1) += $(no-fortify-source),-D_FORTIFY_SOURCE=$(3) -Wno-format \
> +CFLAGS-tst-fortify-$(1)-$(2)-$(3)-$(4).$(1) += $(no-fortify-source) -D_FORTIFY_SOURCE=$(3) \
> +					  -Wno-format \

Ok.

> diff --git a/io/Makefile b/io/Makefile
> -CFLAGS-tst-read-zero.c += $(no-fortify-source),-D_FORTIFY_SOURCE=$(supported-fortify)
> +CFLAGS-tst-read-zero.c += $(no-fortify-source) -D_FORTIFY_SOURCE=$(supported-fortify)

Ok.

> diff --git a/stdio-common/Makefile b/stdio-common/Makefile
> -CFLAGS-tst-bz11319-fortify2.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> +CFLAGS-tst-bz11319-fortify2.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2

Ok.

> diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile
> -CPPFLAGS-tst-wchar-h.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
> +CPPFLAGS-tst-wchar-h.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2

Ok.
diff mbox series

Patch

diff --git a/configure b/configure
index ec0b62db36..58bfb2917f 100755
--- a/configure
+++ b/configure
@@ -7718,7 +7718,7 @@  printf "%s\n" "#define HAVE_LIBCAP 1" >>confdefs.h
 fi
 
 
-no_fortify_source="-Wp,-U_FORTIFY_SOURCE"
+no_fortify_source="-U_FORTIFY_SOURCE"
 fortify_source="${no_fortify_source}"
 
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for maximum supported _FORTIFY_SOURCE level" >&5
@@ -7773,7 +7773,7 @@  esac
 
 if test "$libc_cv_fortify_source" = yes
 then :
-  fortify_source="${fortify_source},-D_FORTIFY_SOURCE=${enable_fortify_source}"
+  fortify_source="${fortify_source} -D_FORTIFY_SOURCE=${enable_fortify_source}"
 
 fi
 
diff --git a/configure.ac b/configure.ac
index 7c9b57789e..5af742ce41 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1536,7 +1536,7 @@  dnl If not, then don't use it.
 dnl Note that _FORTIFY_SOURCE may have been set through FLAGS too.
 dnl _FORTIFY_SOURCE value will be selectively disabled for function that can't
 dnl support it
-no_fortify_source="-Wp,-U_FORTIFY_SOURCE"
+no_fortify_source="-U_FORTIFY_SOURCE"
 fortify_source="${no_fortify_source}"
 
 AC_CACHE_CHECK([for maximum supported _FORTIFY_SOURCE level],
@@ -1555,7 +1555,7 @@  AS_CASE([$enable_fortify_source],
         [libc_cv_fortify_source=no])
 
 AS_IF([test "$libc_cv_fortify_source" = yes],
-      [fortify_source="${fortify_source},-D_FORTIFY_SOURCE=${enable_fortify_source}"]
+      [fortify_source="${fortify_source} -D_FORTIFY_SOURCE=${enable_fortify_source}"]
       )
 
 AC_SUBST(enable_fortify_source)
diff --git a/debug/Makefile b/debug/Makefile
index 3903cc97a3..89ee80bf4d 100644
--- a/debug/Makefile
+++ b/debug/Makefile
@@ -171,16 +171,16 @@  CFLAGS-recvfrom_chk.c += -fexceptions -fasynchronous-unwind-tables
 # set up for us, so keep the CFLAGS/CPPFLAGS split logical as the order is:
 # <user CFLAGS> <test CFLAGS> <user CPPFLAGS> <test CPPFLAGS>
 CFLAGS-tst-longjmp_chk.c += -fexceptions -fasynchronous-unwind-tables
-CPPFLAGS-tst-longjmp_chk.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-longjmp_chk.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk2.c += -fexceptions -fasynchronous-unwind-tables
-CPPFLAGS-tst-longjmp_chk2.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-longjmp_chk2.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
 CFLAGS-tst-longjmp_chk3.c += -fexceptions -fasynchronous-unwind-tables
-CPPFLAGS-tst-longjmp_chk3.c += $(no-fortify-source),-D_FORTIFY_SOURCE=1
-CPPFLAGS-tst-realpath-chk.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
-CPPFLAGS-tst-chk-cancel.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
-CFLAGS-tst-sprintf-fortify-rdonly.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
-CFLAGS-tst-fortify-syslog.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
-CFLAGS-tst-fortify-wide.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
+CPPFLAGS-tst-longjmp_chk3.c += $(no-fortify-source) -D_FORTIFY_SOURCE=1
+CPPFLAGS-tst-realpath-chk.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
+CPPFLAGS-tst-chk-cancel.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
+CFLAGS-tst-sprintf-fortify-rdonly.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
+CFLAGS-tst-fortify-syslog.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
+CFLAGS-tst-fortify-wide.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
 
 # _FORTIFY_SOURCE tests.
 # Auto-generate tests for _FORTIFY_SOURCE for different levels, compilers and
@@ -218,7 +218,8 @@  src-chk-nongnu = \#undef _GNU_SOURCE
 # cannot be disabled via pragmas, so require -Wno-error to be used.
 define gen-chk-test
 tests-$(1)-$(4)-chk += tst-fortify-$(1)-$(2)-$(3)-$(4)
-CFLAGS-tst-fortify-$(1)-$(2)-$(3)-$(4).$(1) += $(no-fortify-source),-D_FORTIFY_SOURCE=$(3) -Wno-format \
+CFLAGS-tst-fortify-$(1)-$(2)-$(3)-$(4).$(1) += $(no-fortify-source) -D_FORTIFY_SOURCE=$(3) \
+					  -Wno-format \
 					  -Wno-deprecated-declarations \
 					  -Wno-error
 $(eval $(call cflags-$(2),$(1),$(3),$(4)))
diff --git a/io/Makefile b/io/Makefile
index 47666a1deb..56de61d687 100644
--- a/io/Makefile
+++ b/io/Makefile
@@ -292,7 +292,7 @@  CFLAGS-read.c += -fexceptions -fasynchronous-unwind-tables $(config-cflags-wno-i
 CFLAGS-write.c += -fexceptions -fasynchronous-unwind-tables $(config-cflags-wno-ignored-attributes)
 CFLAGS-close.c += -fexceptions -fasynchronous-unwind-tables
 CFLAGS-lseek64.c += $(config-cflags-wno-ignored-attributes)
-CFLAGS-tst-read-zero.c += $(no-fortify-source),-D_FORTIFY_SOURCE=$(supported-fortify)
+CFLAGS-tst-read-zero.c += $(no-fortify-source) -D_FORTIFY_SOURCE=$(supported-fortify)
 
 CFLAGS-test-stat.c += -D_FILE_OFFSET_BITS=64 -D_LARGEFILE64_SOURCE
 CFLAGS-test-lfs.c += -D_LARGEFILE64_SOURCE
diff --git a/stdio-common/Makefile b/stdio-common/Makefile
index d99e0cbfeb..f9ae48dc3b 100644
--- a/stdio-common/Makefile
+++ b/stdio-common/Makefile
@@ -558,7 +558,7 @@  CFLAGS-tst-gets.c += -Wno-deprecated-declarations
 
 # BZ #11319 was first fixed for regular vdprintf, then reopened because
 # the fortified version had the same bug.
-CFLAGS-tst-bz11319-fortify2.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
+CFLAGS-tst-bz11319-fortify2.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
 
 CFLAGS-tst-memstream-string.c += -fno-builtin-fprintf
 
diff --git a/wcsmbs/Makefile b/wcsmbs/Makefile
index 63adf0e8ef..37a44e62c3 100644
--- a/wcsmbs/Makefile
+++ b/wcsmbs/Makefile
@@ -264,7 +264,7 @@  CFLAGS-wcstod_l.c += $(strtox-CFLAGS) $(config-cflags-wno-ignored-attributes)
 CFLAGS-wcstold_l.c += $(strtox-CFLAGS) $(config-cflags-wno-ignored-attributes)
 CFLAGS-wcstof128_l.c += $(strtox-CFLAGS)
 CFLAGS-wcstof_l.c += $(strtox-CFLAGS) $(config-cflags-wno-ignored-attributes)
-CPPFLAGS-tst-wchar-h.c += $(no-fortify-source),-D_FORTIFY_SOURCE=2
+CPPFLAGS-tst-wchar-h.c += $(no-fortify-source) -D_FORTIFY_SOURCE=2
 
 CFLAGS-wcschr.c += $(config-cflags-wno-ignored-attributes)
 CFLAGS-wmemchr.c += $(config-cflags-wno-ignored-attributes)