tree 5e764b20758e7e3274f552a30491f3f3b652bf57
parent 9ca830b4d7ae9ff76f64f4f9f78a0a0b88dfcda4
author glider@google.com <glider@google.com> 1592296475 +0200
committer Roy Yang <royyang@google.com> 1602778555 +0000

security: allow using Clang's zero initialization for stack variables

Upstream commit f0fe00d4972a8cd4b98cc2c29758615e4d51cdfe.

In addition to -ftrivial-auto-var-init=pattern (used by
CONFIG_INIT_STACK_ALL now) Clang also supports zero initialization for
locals enabled by -ftrivial-auto-var-init=zero. The future of this flag
is still being debated (see https://bugs.llvm.org/show_bug.cgi?id=45497).
Right now it is guarded by another flag,
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang,
which means it may not be supported by future Clang releases. Another
possible resolution is that -ftrivial-auto-var-init=zero will persist
(as certain users have already started depending on it), but the name
of the guard flag will change.

In the meantime, zero initialization has proven itself as a good
production mitigation measure against uninitialized locals. Unlike pattern
initialization, which has a higher chance of triggering existing bugs,
zero initialization provides safe defaults for strings, pointers, indexes,
and sizes. On the other hand, pattern initialization remains safer for
return values. Chrome OS and Android are moving to using zero
initialization for production builds.

Performance-wise, the difference between pattern and zero initialization
is usually negligible, although the generated code for zero
initialization is more compact.

This patch renames CONFIG_INIT_STACK_ALL to CONFIG_INIT_STACK_ALL_PATTERN
and introduces another config option, CONFIG_INIT_STACK_ALL_ZERO, that
enables zero initialization for locals if the corresponding flags are
supported by Clang.

BUG=b/169936557
TEST=compile
SOURCE=UPSTREAM(f0fe00d4972a8cd4b98cc2c29758615e4d51cdfe)

Cc: Kees Cook <keescook@chromium.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Alexander Potapenko <glider@google.com>
Link: https://lore.kernel.org/r/20200616083435.223038-1-glider@google.com
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Change-Id: I3c69570e7e3d3bbb666709de6feb531000bce2bf
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/7120
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Vaibhav Rustagi <vaibhavrustagi@google.com>
(cherry picked from commit 007971ab7111f9397d3dfacb56a4af0924e65bcd)
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/7420