Re: [GIT PULL] hardening updates for v6.18-rc1

[Kees Cook]

On Mon, Sep 29, 2025 at 05:59:17PM -0700, Linus Torvalds wrote:
> On Mon, 29 Sept 2025 at 12:15, Kees Cook <kees@xxxxxxxxxx> wrote:
> >
> > Please pull these hardening updates for v6.18-rc1. One notable addition
> > is the creation of the "transitional" keyword for kconfig so CONFIG
> > renaming can go more smoothly. This has been a long-standing deficiency,
> > and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will
> > soon have KCFI support), this came up again. The breadth of the diffstat
> > is mainly this renaming.
> 
> So I really like this addition conceptually, but it doesn't actually
> seem to work.
> 
> My clang-building tree config had
> 
>     CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
>     # CONFIG_CFI_CLANG is not set
>     CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y
> 
> but then when I pulled this and did a "make oldconfig" I get Kconfig asking me
> 
>     Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW)
> 
> anyway, in order to get
> 
>     CONFIG_ARCH_SUPPORTS_CFI=y
>     # CONFIG_CFI is not set
>     CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y
> 
> and I thought the whole point was that it would recognize the old
> Kconfig names and transition them to the new ones. And it very clearly
> does not.
> 
> So I'm a bit disappointed. Possibly because I expected the
> "transitional" keyword to be doing more than it does. But possibly
> because it's buggy and doesn't actually do what it is *supposed* to
> do.

Ah, the existing "=n" didn't persist. That's not expected. I will take
a look.

-- 
Kees Cook