linux-kernel - Re: [PATCH v2] [RFC] security: allow using Clang's zero initialization for stack variables

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAG_fn=VYN6ynu2bnW96-p-QRi77NstHC6DXS+AN0r0bm5K2j7w@mail.gmail.com>
Date:   Tue, 16 Jun 2020 14:15:52 +0200
From:   Alexander Potapenko <glider@...gle.com>
To:     Greg KH <gregkh@...uxfoundation.org>
Cc:     Masahiro Yamada <yamada.masahiro@...ionext.com>,
        Kees Cook <keescook@...omium.org>,
        James Morris <jmorris@...ei.org>,
        Maciej Żenczykowski <maze@...gle.com>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        linux-security-module <linux-security-module@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] [RFC] security: allow using Clang's zero
 initialization for stack variables

> > +KBUILD_CFLAGS        += -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
> > +endif
>
> Gotta love the name...

This is basically the reason why we've been hesitating to add it to
the kernel from the very beginning.

> Anyway, if this is enabled, and clang changes the flag or drops it, does
> the build suddenly break?

My original intention (see v1 of this patch) was to make
zero-initialization a secondary option of INIT_STACK_ALL, so that
nothing changes for the existing users.
But I agree with Kees that these options should be made distinct, as
people may want to use them for different purposes (think debug vs.
release builds).

We could make INIT_STACK_ALL_ZERO fall back to INIT_STACK_ALL_PATTERN
if the compiler flag goes away - does this make sense?

> And does gcc have something like this as well, or does that have to come
> in a compiler plugin?

Kees mentioned someone's plans to implement that in GCC, but I don't
think they have done it already.