[clang] [clang] Enable -fstack-clash-protection by default for Android (PR #209279)
Sidhartha kumar via cfe-commits
cfe-commits at lists.llvm.org
Fri Aug 14 09:23:28 PDT 2026
https://github.com/Alearner12 updated https://github.com/llvm/llvm-project/pull/209279
>From 315d0391fc38282da1541fa40735afeab2db3363 Mon Sep 17 00:00:00 2001
From: Alearner12 <siddharthtiwari155 at yahoo.com>
Date: Fri, 14 Aug 2026 21:26:36 +0530
Subject: [PATCH 1/2] [clang][test] Simplify stack clash protection driver
checks
Use shared ENABLED/DISABLED prefixes and --implicit-check-not instead of
per-target prefixes and -NOT lines.
---
clang/test/Driver/stack-clash-protection.c | 30 ++++++++++------------
1 file changed, 14 insertions(+), 16 deletions(-)
diff --git a/clang/test/Driver/stack-clash-protection.c b/clang/test/Driver/stack-clash-protection.c
index 3b0476db9d3cb..7e7ff303a1118 100644
--- a/clang/test/Driver/stack-clash-protection.c
+++ b/clang/test/Driver/stack-clash-protection.c
@@ -1,15 +1,14 @@
-// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386
-// RUN: %clang -target i386-unknown-linux -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386
-// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-i386-NO
-// SCP-i386: "-fstack-clash-protection"
-// SCP-i386-NO-NOT: "-fstack-clash-protection"
-
-// RUN: %clang -target x86_64-scei-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-x86
-// RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-x86
-// SCP-x86: "-fstack-clash-protection"
-
-// RUN: %clang -target armv7k-apple-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-armv7
-// SCP-armv7-NOT: "-fstack-clash-protection"
+// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target i386-unknown-linux -fno-stack-clash-protection -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target i386-unknown-linux -fstack-clash-protection -fno-stack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"'
+
+// RUN: %clang -target x86_64-scei-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+
+// ENABLED: "-fstack-clash-protection"
+// DISABLED: "-cc1"
+
+// RUN: %clang -target armv7k-apple-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=SCP-armv7 --implicit-check-not='"-fstack-clash-protection"'
// SCP-armv7: argument unused during compilation: '-fstack-clash-protection'
// RUN: %clang -target x86_64-unknown-linux -fstack-clash-protection -S -emit-llvm -o %t.ll %s 2>&1 | FileCheck %s -check-prefix=SCP-warn
@@ -22,10 +21,9 @@
// SCP-ll-win64-NOT: attributes {{.*}} "probe-stack"="inline-asm"
// SCP-ll-win64: argument unused during compilation: '-fstack-clash-protection'
-// RUN: %clang -target x86_64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA
-// RUN: %clang -target aarch64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA
-// RUN: %clang -target riscv64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s -check-prefix=SCP-FUCHSIA
-// SCP-FUCHSIA: "-fstack-clash-protection"
+// RUN: %clang -target x86_64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target aarch64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target riscv64-unknown-fuchsia -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
int foo(int c) {
int r;
>From e2f9522d7484bcd84972bc9bfe11c2acac2bb8fb Mon Sep 17 00:00:00 2001
From: Alearner12 <siddharthtiwari155 at yahoo.com>
Date: Fri, 14 Aug 2026 21:28:42 +0530
Subject: [PATCH 2/2] [clang] Enable -fstack-clash-protection by default for
Android
Enable -fstack-clash-protection by default for Android targets on
architectures where Clang already supports stack clash protection, as per
the RFC:
https://discourse.llvm.org/t/rfc-enable-fstack-clash-protection-by-default-for-android-targets/91223
---
clang/include/clang/Driver/ToolChain.h | 3 +++
clang/lib/Driver/ToolChains/Clang.cpp | 6 ++++--
clang/lib/Driver/ToolChains/Linux.cpp | 4 ++++
clang/lib/Driver/ToolChains/Linux.h | 1 +
clang/test/Driver/stack-clash-protection.c | 6 ++++++
5 files changed, 18 insertions(+), 2 deletions(-)
diff --git a/clang/include/clang/Driver/ToolChain.h b/clang/include/clang/Driver/ToolChain.h
index c5633e10933e8..8afb9a6cb4197 100644
--- a/clang/include/clang/Driver/ToolChain.h
+++ b/clang/include/clang/Driver/ToolChain.h
@@ -537,6 +537,9 @@ class ToolChain {
return LangOptions::SSPOff;
}
+ /// Does this tool chain enable -fstack-clash-protection by default.
+ virtual bool IsStackClashProtectionDefault() const { return false; }
+
/// Get the default trivial automatic variable initialization.
virtual LangOptions::TrivialAutoVarInitKind
GetDefaultTrivialAutoVarInit() const {
diff --git a/clang/lib/Driver/ToolChains/Clang.cpp b/clang/lib/Driver/ToolChains/Clang.cpp
index 91ad5be238f5d..9ec9f8736dfe5 100644
--- a/clang/lib/Driver/ToolChains/Clang.cpp
+++ b/clang/lib/Driver/ToolChains/Clang.cpp
@@ -3836,8 +3836,10 @@ static void RenderSCPOptions(const ToolChain &TC, const ArgList &Args,
!EffectiveTriple.isRISCV() && !EffectiveTriple.isLoongArch())
return;
- Args.addOptInFlag(CmdArgs, options::OPT_fstack_clash_protection,
- options::OPT_fno_stack_clash_protection);
+ if (Args.hasFlag(options::OPT_fstack_clash_protection,
+ options::OPT_fno_stack_clash_protection,
+ TC.IsStackClashProtectionDefault()))
+ CmdArgs.push_back("-fstack-clash-protection");
}
static void RenderTrivialAutoVarInitOptions(const Driver &D,
diff --git a/clang/lib/Driver/ToolChains/Linux.cpp b/clang/lib/Driver/ToolChains/Linux.cpp
index e295b2516da16..fdc27058780bb 100644
--- a/clang/lib/Driver/ToolChains/Linux.cpp
+++ b/clang/lib/Driver/ToolChains/Linux.cpp
@@ -950,6 +950,10 @@ bool Linux::isPIEDefault(const llvm::opt::ArgList &Args) const {
getTriple().isMusl() || getSanitizerArgs(Args).requiresPIE();
}
+bool Linux::IsStackClashProtectionDefault() const {
+ return getTriple().isAndroid();
+}
+
bool Linux::IsAArch64OutlineAtomicsDefault(const ArgList &Args) const {
// Outline atomics for AArch64 are supported by compiler-rt
// and libgcc since 9.3.1
diff --git a/clang/lib/Driver/ToolChains/Linux.h b/clang/lib/Driver/ToolChains/Linux.h
index 6c81bbc71f7c2..12d8ae466fa76 100644
--- a/clang/lib/Driver/ToolChains/Linux.h
+++ b/clang/lib/Driver/ToolChains/Linux.h
@@ -51,6 +51,7 @@ class LLVM_LIBRARY_VISIBILITY Linux : public Generic_ELF {
IsAArch64OutlineAtomicsDefault(const llvm::opt::ArgList &Args) const override;
bool isPIEDefault(const llvm::opt::ArgList &Args) const override;
bool IsMathErrnoDefault() const override;
+ bool IsStackClashProtectionDefault() const override;
SanitizerMask
getSupportedSanitizers(BoundArch BA,
Action::OffloadKind DeviceOffloadKind) const override;
diff --git a/clang/test/Driver/stack-clash-protection.c b/clang/test/Driver/stack-clash-protection.c
index 7e7ff303a1118..a3a8440af1d64 100644
--- a/clang/test/Driver/stack-clash-protection.c
+++ b/clang/test/Driver/stack-clash-protection.c
@@ -5,6 +5,12 @@
// RUN: %clang -target x86_64-scei-linux -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
// RUN: %clang -target x86_64-unknown-freebsd -fstack-clash-protection -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// RUN: %clang -target x86_64-unknown-linux -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"'
+
+// RUN: %clang -target aarch64-linux-android -### %s 2>&1 | FileCheck %s --check-prefix=ENABLED
+// 32-bit Arm does not support stack clash protection.
+// RUN: %clang -target armv7-linux-androideabi -### %s 2>&1 | FileCheck %s --check-prefix=DISABLED --implicit-check-not='"-fstack-clash-protection"'
+
// ENABLED: "-fstack-clash-protection"
// DISABLED: "-cc1"
More information about the cfe-commits
mailing list