1 files changed, 19 insertions, 0 deletions

diff --git a/scripts/gcc-plugins/Kconfig b/scripts/gcc-plugins/Kconfig
index cb0c889e13aa..977b84e69787 100644
--- a/scripts/gcc-plugins/Kconfig
+++ b/scripts/gcc-plugins/Kconfig
@@ -139,4 +139,23 @@ config GCC_PLUGIN_RANDSTRUCT_PERFORMANCE
           in structures.  This reduces the performance hit of RANDSTRUCT
           at the cost of weakened randomization.
 
+config GCC_PLUGIN_STACKLEAK
+        bool "Erase the kernel stack before returning from syscalls"
+        depends on GCC_PLUGINS
+        depends on HAVE_ARCH_STACKLEAK
+        help
+          This option makes the kernel erase the kernel stack before
+          returning from system calls. That reduces the information which
+          kernel stack leak bugs can reveal and blocks some uninitialized
+          stack variable attacks.
+
+          The tradeoff is the performance impact: on a single CPU system kernel
+          compilation sees a 1% slowdown, other systems and workloads may vary
+          and you are advised to test this feature on your expected workload
+          before deploying it.
+
+          This plugin was ported from grsecurity/PaX. More information at:
+           * https://grsecurity.net/
+           * https://pax.grsecurity.net/
+
 endif