• glider@google.com's avatar
    security: allow using Clang's zero initialization for stack variables · f0fe00d4
    glider@google.com authored
    In addition to -ftrivial-auto-var-init=pattern (used by
    CONFIG_INIT_STACK_ALL now) Clang also supports zero initialization for
    locals enabled by -ftrivial-auto-var-init=zero. The future of this flag
    is still being debated (see https://bugs.llvm.org/show_bug.cgi?id=45497).
    Right now it is guarded by another flag,
    -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang,
    which means it may not be supported by future Clang releases. Another
    possible resolution is that -ftrivial-auto-var-init=zero will persist
    (as certain users have already started depending on it), but the name
    of the guard flag will change.
    
    In the meantime, zero initialization has proven itself as a good
    production mitigation measure against uninitialized locals. Unlike pattern
    initialization, which has a higher chance of triggering existing bugs,
    zero initialization provides safe defaults for strings, pointers, indexes,
    and sizes. On the other hand, pattern initialization remains safer for
    return values. Chrome OS and Android are moving to using zero
    initialization for production builds.
    
    Performance-wise, the difference between pattern and zero initialization
    is usually negligible, although the generated code for zero
    initialization is more compact.
    
    This patch renames CONFIG_INIT_STACK_ALL to CONFIG_INIT_STACK_ALL_PATTERN
    and introduces another config option, CONFIG_INIT_STACK_ALL_ZERO, that
    enables zero initialization for locals if the corresponding flags are
    supported by Clang.
    
    Cc: Kees Cook <keescook@chromium.org>
    Cc: Nick Desaulniers <ndesaulniers@google.com>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: default avatarAlexander Potapenko <glider@google.com>
    Link: https://lore.kernel.org/r/20200616083435.223038-1-glider@google.comReviewed-by: default avatarMaciej Żenczykowski <maze@google.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    f0fe00d4
Makefile 61 KB