Re: [GIT PULL] hardening updates for v6.18-rc1

[Linus Torvalds]

On Mon, 29 Sept 2025 at 12:15, Kees Cook <kees@xxxxxxxxxx> wrote:
>
> Please pull these hardening updates for v6.18-rc1. One notable addition
> is the creation of the "transitional" keyword for kconfig so CONFIG
> renaming can go more smoothly. This has been a long-standing deficiency,
> and with the renaming of CONFIG_CFI_CLANG to CONFIG_CFI (since GCC will
> soon have KCFI support), this came up again. The breadth of the diffstat
> is mainly this renaming.

So I really like this addition conceptually, but it doesn't actually
seem to work.

My clang-building tree config had

    CONFIG_ARCH_SUPPORTS_CFI_CLANG=y
    # CONFIG_CFI_CLANG is not set
    CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS_CLANG=y

but then when I pulled this and did a "make oldconfig" I get Kconfig asking me

    Use Kernel Control Flow Integrity (kCFI) (CFI) [N/y/?] (NEW)

anyway, in order to get

    CONFIG_ARCH_SUPPORTS_CFI=y
    # CONFIG_CFI is not set
    CONFIG_HAVE_CFI_ICALL_NORMALIZE_INTEGERS=y

and I thought the whole point was that it would recognize the old
Kconfig names and transition them to the new ones. And it very clearly
does not.

So I'm a bit disappointed. Possibly because I expected the
"transitional" keyword to be doing more than it does. But possibly
because it's buggy and doesn't actually do what it is *supposed* to
do.

Hmm?

I've pulled this because it doesn't seem wrong, but it does seem to be
less capable than what I was expecting / hoping it to be.

In other words: the long-standing deficiency still stands tall and not-so-proud.

           Linus