Re: [PATCH 1/1] scripts: kstack_erase: use relative stackleak plugin path

Nicolas Schier <[email protected]> Wed, 22 Jul 2026 16:45:56 +0200

Newsgroups	org.kernel.vger.linux-kbuild,org.kernel.vger.linux-hardening,org.kernel.vger.linux-kernel
Organization	FRITZ! Technology GmbH
Message-ID	<20260722-ubiquitous-stork-of-hail-3ba047@l-nschier-aarch64>

Hi Jaihind,

On Mon, Jul 20, 2026 at 03:05:45PM +0530, Jaihind Yadav wrote:
> GCC records full compiler command lines in DWARF producer strings by\ndefault. With CONFIG_KSTACK_ERASE, the stackleak plugin is currently\npassed using an absolute -fplugin path, which can leak host-specific\nbuild paths into debug artifacts.\n\nResolve the stackleak plugin directory relative to the current build\ndirectory and use that in the -fplugin option, falling back to the\nexisting absolute objtree path when needed.\n\nThis keeps plugin loading behavior unchanged while avoiding absolute\nworkspace paths in recorded compiler flags.

Please note: while the patch below is applicable, your commit message is 
broken ("\n" instead of newlines).




Can you give me a hint on how to reproduce the described behaviour?
I enabled

CONFIG_DEBUG_INFO=y
CONFIG_DEBUG_INFO_DWARF5=y
CONFIG_KSTACK_ERASE=y

and built with O=build but cannot find the path to the plugin dir in any 
binary build artifact I grep'ed.  What do I have to do to find the 
plugin path there?

[...]
> diff --git a/scripts/Makefile.kstack_erase b/scripts/Makefile.kstack_erase
> index ee7e4ef7b8926..006d10f3b77a0 100644
> --- a/scripts/Makefile.kstack_erase
> +++ b/scripts/Makefile.kstack_erase
> @@ -1,7 +1,10 @@
>  # SPDX-License-Identifier: GPL-2.0
>  
>  ifdef CONFIG_GCC_PLUGIN_STACKLEAK
> -kstack-erase-cflags-y += -fplugin=$(objtree)/scripts/gcc-plugins/stackleak_plugin.so
> +stackleak-plugin-dir := $(or \
> +	$(shell realpath -m --relative-to=$(CURDIR) $(objtree)/scripts/gcc-plugins 2>/dev/null), \
> +	$(objtree)/scripts/gcc-plugins)
> +kstack-erase-cflags-y += -fplugin=$(stackleak-plugin-dir)/stackleak_plugin.so

As Kbuild changes the working directory to KBUILD_OUTPUT build dir for 
compilation, I'd assume that '$(objtree)/' should just be removed and 
scripts/gcc-plugins/stackleak_plugin.so be the always matching relative 
path to the plugin:

-kstack-erase-cflags-y += -fplugin=$(objtree)/scripts/gcc-plugins/stackleak_plugin.so
+kstack-erase-cflags-y += -fplugin=scripts/gcc-plugins/stackleak_plugin.so

Does that work for you?

Kind regards,
Nicolas

signature.asc (application/pgp-signature, 833 B)