Re: [PATCH v3 09/21] kbuild: Only run objtool if there is at least one command
From: Josh Poimboeuf <jpoimboe@kernel.org>
Date: 2026-08-07 22:41:55
Also in:
live-patching, lkml
Subsystem:
kernel build + files below scripts/ (unless maintained elsewhere), the rest · Maintainers:
Nathan Chancellor, Nicolas Schier, Linus Torvalds
On Thu, May 14, 2026 at 10:25:15PM +0000, sashiko-bot@kernel.org wrote:
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [Low] Leaking objtool options into vmlinux.o validation causes a fatal build failure (`--cfi requires --prefix`) and silently alters validation behavior. -- commit 68e454f3a8ccd3d638c67c092eee264996286695 Author: Josh Poimboeuf [off-list ref] kbuild: Only run objtool if there is at least one command This commit splits the objtool arguments into commands and options to prevent objtool from running when no commands are enabled.quoted
diff --git a/scripts/Makefile.vmlinux_o b/scripts/Makefile.vmlinux_o index 527352c222ff6..09af33203bd8d 100644 --- a/scripts/Makefile.vmlinux_o +++ b/scripts/Makefile.vmlinux_o[ ... ]quoted
@@ -36,18 +36,13 @@ endif # For !delay-objtool + CONFIG_NOINSTR_VALIDATION, it runs on both translation # units and vmlinux.o, with the latter only used for noinstr/unret validation. -objtool-enabled := $(or $(delay-objtool),$(CONFIG_NOINSTR_VALIDATION)) - -ifeq ($(delay-objtool),y) -vmlinux-objtool-args-y += $(objtool-args-y) -else -vmlinux-objtool-args-$(CONFIG_OBJTOOL_WERROR) += --werror +ifneq ($(delay-objtool),y) +objtool-cmds-y = +objtool-opts-y += --linkDoes this code unintentionally retain the options from scripts/Makefile.lib? Since objtool-cmds-y is cleared here, commands like --prefix are dropped. However, because objtool-opts-y is only appended to, options like --cfi remain active. This causes objtool to fail with a fatal error: "--cfi requires --prefix" during vmlinux.o validation on configurations with KCFI. Should objtool-opts-y be assigned directly using = or := instead of appended?
Indeed, adding this on top:
diff --git a/scripts/Makefile.vmlinux_o b/scripts/Makefile.vmlinux_o
index dc0a5d19f383c..729f82eb85b35 100644
--- a/scripts/Makefile.vmlinux_o
+++ b/scripts/Makefile.vmlinux_o@@ -38,7 +38,8 @@ endif ifneq ($(delay-objtool),y) objtool-cmds-y = -objtool-opts-y += --link +objtool-opts-y = --link +objtool-opts-$(CONFIG_OBJTOOL_WERROR) += --werror endif objtool-cmds-$(CONFIG_NOINSTR_VALIDATION) += --noinstr \