hardening: Default to INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO

PATCH In review Will Deacon 4 participants 8 messages Sep 14, 2021

Subsystems (3)

Kbuild Security (LSM) Kernel hardening (not covered by other areas)

lore

Share & tools

lore

Will Deacon

author

2021-09-14 10:28 UTC #0 lore raw

PATCH 1/1 hardening: Default to INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO

CC_HAS_AUTO_VAR_INIT_ZERO requires a supported set of compiler options distinct from those needed by CC_HAS_AUTO_VAR_INIT_PATTERN, Fix up the Kconfig dependency for INIT_STACK_ALL_ZERO to test for the former instead of the latter, as these are the options passed by the top-level Makefile.

Cc Kees Cook <[email protected]>

Cc Nathan Chancellor <[email protected]>

Cc Nick Desaulniers <[email protected]>

Cc Gustavo A. R. Silva <[email protected]>

Cc Greg Kroah-Hartman <[email protected]>

Fixes dcb7c0b9461c ("hardening: Clarify Kconfig text for auto-var-init")

Signed-off-by Will Deacon <[email protected]>

---

I just noticed this while reading the code and I suspect it doesn't really matter in practice.

 security/Kconfig.hardening | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

security/Kconfig.hardening +1 -1

index 90cbaff86e13..341e2fdcba94 100644
@@ -29,7 +29,7 @@ choice
 	prompt "Initialize kernel stack variables at function entry"
 	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
 	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
 	default INIT_STACK_NONE
 	help
 	  This option enables initialization of stack variables at

Signature · 1 line

2.33.0.309.g3052b89438-goog

Nathan Chancellor

maintainer Reviewed-by on v1 1/1

2021-09-14 15:58 UTC #1 lore raw

Quoted 6 lines · Will Deacon

CC_HAS_AUTO_VAR_INIT_ZERO requires a supported set of compiler options distinct from those needed by CC_HAS_AUTO_VAR_INIT_PATTERN, Fix up the Kconfig dependency for INIT_STACK_ALL_ZERO to test for the former instead of the latter, as these are the options passed by the top-level Makefile.

Quoted 7 lines

Cc Kees Cook <[email protected]>
Cc Nathan Chancellor <[email protected]>
Cc Nick Desaulniers <[email protected]>
Cc Gustavo A. R. Silva <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Fixes dcb7c0b9461c ("hardening: Clarify Kconfig text for auto-var-init")
Signed-off-by Will Deacon <[email protected]>

Reviewed-by Nathan Chancellor <[email protected]>

One comment below.

Quoted 14 lines

---
I just noticed this while reading the code and I suspect it doesn't really matter in practice.
  security/Kconfig.hardening | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
security/Kconfig.hardening +0 -0
index 90cbaff86e13..341e2fdcba94 100644

security/Kconfig.hardening choice · line 35

Quoted 8 lines

security/Kconfig.hardening +1 -1

@@ -29,7 +29,7 @@ choice
  	prompt "Initialize kernel stack variables at function entry"
  	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
  	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
  	default INIT_STACK_NONE
  	help
  	  This option enables initialization of stack variables at

While I think this change is correct in and of itself, CONFIG_INIT_STACK_ALL_ZERO is broken with GCC 12.x, as CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO won't be set even though GCC now supports -ftrivial-auto-var-init=zero because GCC does not implement the -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang flag for obvious reasons ;) the cc-option call probably needs to be adjusted.

Cheers,
Nathan

Kees Cook

2021-09-14 17:21 UTC #2 lore raw

Quoted 47 lines · Nathan Chancellor

Quoted 6 lines · Will Deacon
CC_HAS_AUTO_VAR_INIT_ZERO requires a supported set of compiler options distinct from those needed by CC_HAS_AUTO_VAR_INIT_PATTERN, Fix up the Kconfig dependency for INIT_STACK_ALL_ZERO to test for the former instead of the latter, as these are the options passed by the top-level Makefile.
Quoted 7 lines
Cc Kees Cook <[email protected]>
Cc Nathan Chancellor <[email protected]>
Cc Nick Desaulniers <[email protected]>
Cc Gustavo A. R. Silva <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Fixes dcb7c0b9461c ("hardening: Clarify Kconfig text for auto-var-init")
Signed-off-by Will Deacon <[email protected]>
Reviewed-by Nathan Chancellor <[email protected]>
One comment below.
Quoted 14 lines
---
I just noticed this while reading the code and I suspect it doesn't really matter in practice.
  security/Kconfig.hardening | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
security/Kconfig.hardening +0 -0
index 90cbaff86e13..341e2fdcba94 100644
security/Kconfig.hardening choice · line 35
Quoted 8 lines
security/Kconfig.hardening +1 -1
@@ -29,7 +29,7 @@ choice
  	prompt "Initialize kernel stack variables at function entry"
  	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
  	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
  	default INIT_STACK_NONE
  	help
  	  This option enables initialization of stack variables at
While I think this change is correct in and of itself, CONFIG_INIT_STACK_ALL_ZERO is broken with GCC 12.x, as CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO won't be set even though GCC now supports
(quoted diff) +0 -2
-ftrivial-auto-var-init=zero because GCC does not implement the
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang

Quoted 2 lines

flag for obvious reasons ;) the cc-option call probably needs to be adjusted.

GCC silently ignores the -enable flag, so things actually work correctly as-is. But, yes, it makes the command line long and doesn't make sense. How about we do this instead:

Makefile +2 -3

index 34a0afc3a8eb..34439deac939 100644
@@ -831,12 +831,11 @@ endif
 
 # Initialize all stack variables with a zero value.
 ifdef CONFIG_INIT_STACK_ALL_ZERO
-# Future support for zero initialization is still being debated, see
-# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
-# renamed or dropped.
 KBUILD_CFLAGS	+= -ftrivial-auto-var-init=zero
+ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
 KBUILD_CFLAGS	+= -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
 endif
+endif
 
 # While VLAs have been removed, GCC produces unreachable stack probes
 # for the randomize_kstack_offset feature. Disable it for all compilers.

security/Kconfig.hardening +10 -2

index 90cbaff86e13..beea81df3081 100644
@@ -22,14 +22,22 @@ menu "Memory initialization"
 config CC_HAS_AUTO_VAR_INIT_PATTERN
 	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
+config CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE
+	def_bool $(cc-option,-ftrivial-auto-var-init=zero)
+
+config CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
+	# https://bugs.llvm.org/show_bug.cgi?id=45497
+	def_bool !CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE && \
+		 $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
+
 config CC_HAS_AUTO_VAR_INIT_ZERO
-	def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
+	def_bool CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE || CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
 
 choice
 	prompt "Initialize kernel stack variables at function entry"
 	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
 	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
 	default INIT_STACK_NONE
 	help
 	  This option enables initialization of stack variables at

Signature · 1 line

Kees Cook

Nick Desaulniers

2021-09-14 18:53 UTC #3 lore raw

Quoted 46 lines · Kees Cook

Quoted 44 lines · Nathan Chancellor
Quoted 6 lines · Will Deacon
CC_HAS_AUTO_VAR_INIT_ZERO requires a supported set of compiler options distinct from those needed by CC_HAS_AUTO_VAR_INIT_PATTERN, Fix up the Kconfig dependency for INIT_STACK_ALL_ZERO to test for the former instead of the latter, as these are the options passed by the top-level Makefile.
Quoted 7 lines
Cc Kees Cook <[email protected]>
Cc Nathan Chancellor <[email protected]>
Cc Nick Desaulniers <[email protected]>
Cc Gustavo A. R. Silva <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Fixes dcb7c0b9461c ("hardening: Clarify Kconfig text for auto-var-init")
Signed-off-by Will Deacon <[email protected]>
Reviewed-by Nathan Chancellor <[email protected]>
One comment below.
Quoted 14 lines
---
I just noticed this while reading the code and I suspect it doesn't really matter in practice.
  security/Kconfig.hardening | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
security/Kconfig.hardening +0 -0
index 90cbaff86e13..341e2fdcba94 100644
security/Kconfig.hardening choice · line 35
Quoted 8 lines
security/Kconfig.hardening +1 -1
@@ -29,7 +29,7 @@ choice
    prompt "Initialize kernel stack variables at function entry"
    default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
    default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-   default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+   default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
    default INIT_STACK_NONE
    help
      This option enables initialization of stack variables at
While I think this change is correct in and of itself, CONFIG_INIT_STACK_ALL_ZERO is broken with GCC 12.x, as

Quoted 8 lines

Quoted 5 lines
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO won't be set even though GCC now supports
(quoted diff) +0 -2
-ftrivial-auto-var-init=zero because GCC does not implement the
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
flag for obvious reasons ;) the cc-option call probably needs to be adjusted.
GCC silently ignores the -enable flag, so things actually work correctly as-is.

So then would that mean that CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE evaluates to true then, in your patch below?

Rather than create 2 new kconfigs with 1 new invocation of the compiler via cc-option, how about just adding an ifdef CONFIG_CC_IS_CLANG guard around adding the obnoxious flag to KBUILD_CFLAGS in the top level Makefile?

Quoted 56 lines

But, yes, it makes the command line long and doesn't make sense. How about we do this instead:

Makefile +2 -3

index 34a0afc3a8eb..34439deac939 100644
@@ -831,12 +831,11 @@ endif
 
 # Initialize all stack variables with a zero value.
 ifdef CONFIG_INIT_STACK_ALL_ZERO
-# Future support for zero initialization is still being debated, see
-# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
-# renamed or dropped.
 KBUILD_CFLAGS  += -ftrivial-auto-var-init=zero
+ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
 KBUILD_CFLAGS  += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
 endif
+endif
 
 # While VLAs have been removed, GCC produces unreachable stack probes
 # for the randomize_kstack_offset feature. Disable it for all compilers.

security/Kconfig.hardening +10 -3

index 90cbaff86e13..beea81df3081 100644
@@ -22,14 +22,22 @@ menu "Memory initialization"
 config CC_HAS_AUTO_VAR_INIT_PATTERN
        def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
+config CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE
+       def_bool $(cc-option,-ftrivial-auto-var-init=zero)
+
+config CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
+       # https://bugs.llvm.org/show_bug.cgi?id=45497
+       def_bool !CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE && \
+                $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
+
 config CC_HAS_AUTO_VAR_INIT_ZERO
-       def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
+       def_bool CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE || CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE
 
 choice
        prompt "Initialize kernel stack variables at function entry"
        default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
        default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-       default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+       default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
        default INIT_STACK_NONE
        help
          This option enables initialization of stack variables at
 
 
 
--

Kees Cook

Signature · 2 lines

Thanks,
~Nick Desaulniers

Kees Cook

2021-09-14 19:09 UTC #4 lore raw

Quoted 56 lines · Nick Desaulniers

Quoted 46 lines · Kees Cook
Quoted 44 lines · Nathan Chancellor
Quoted 6 lines · Will Deacon
CC_HAS_AUTO_VAR_INIT_ZERO requires a supported set of compiler options distinct from those needed by CC_HAS_AUTO_VAR_INIT_PATTERN, Fix up the Kconfig dependency for INIT_STACK_ALL_ZERO to test for the former instead of the latter, as these are the options passed by the top-level Makefile.
Quoted 7 lines
Cc Kees Cook <[email protected]>
Cc Nathan Chancellor <[email protected]>
Cc Nick Desaulniers <[email protected]>
Cc Gustavo A. R. Silva <[email protected]>
Cc Greg Kroah-Hartman <[email protected]>
Fixes dcb7c0b9461c ("hardening: Clarify Kconfig text for auto-var-init")
Signed-off-by Will Deacon <[email protected]>
Reviewed-by Nathan Chancellor <[email protected]>
One comment below.
Quoted 14 lines
---
I just noticed this while reading the code and I suspect it doesn't really matter in practice.
  security/Kconfig.hardening | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
security/Kconfig.hardening +0 -0
index 90cbaff86e13..341e2fdcba94 100644
security/Kconfig.hardening choice · line 35
Quoted 8 lines
security/Kconfig.hardening +1 -1
@@ -29,7 +29,7 @@ choice
    prompt "Initialize kernel stack variables at function entry"
    default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
    default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-   default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+   default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
    default INIT_STACK_NONE
    help
      This option enables initialization of stack variables at
While I think this change is correct in and of itself, CONFIG_INIT_STACK_ALL_ZERO is broken with GCC 12.x, as
Quoted 8 lines
Quoted 5 lines
CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO won't be set even though GCC now supports
(quoted diff) +0 -2
-ftrivial-auto-var-init=zero because GCC does not implement the
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
flag for obvious reasons ;) the cc-option call probably needs to be adjusted.
GCC silently ignores the -enable flag, so things actually work correctly as-is.

Quoted 2 lines

So then would that mean that CC_HAS_AUTO_VAR_INIT_ZERO_WITH_ENABLE evaluates to true then, in your patch below?

No, I exclude it based on the results from
CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE.

here:

Quoted 6 lines

Quoted 1 line
+ def_bool !CC_HAS_AUTO_VAR_INIT_ZERO_WITHOUT_ENABLE && \
Rather than create 2 new kconfigs with 1 new invocation of the compiler via cc-option, how about just adding an ifdef CONFIG_CC_IS_CLANG guard around adding the obnoxious flag to KBUILD_CFLAGS in the top level Makefile?

That is a bit more sensible, yes. :) Let me try that...

Signature · 1 line

Kees Cook

Kees Cook

2021-09-14 19:14 UTC #5 lore raw

In reply to Nick Desaulniers

Quoted 4 lines · Nick Desaulniers

Rather than create 2 new kconfigs with 1 new invocation of the compiler via cc-option, how about just adding an ifdef CONFIG_CC_IS_CLANG guard around adding the obnoxious flag to KBUILD_CFLAGS in the top level Makefile?

v2:

Makefile +3 -3

index 34a0afc3a8eb..72d165ffabdb 100644
@@ -831,12 +831,12 @@ endif
 
 # Initialize all stack variables with a zero value.
 ifdef CONFIG_INIT_STACK_ALL_ZERO
-# Future support for zero initialization is still being debated, see
-# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
-# renamed or dropped.
 KBUILD_CFLAGS	+= -ftrivial-auto-var-init=zero
+ifdef CONFIG_CC_IS_CLANG
+# https://bugs.llvm.org/show_bug.cgi?id=45497
 KBUILD_CFLAGS	+= -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
 endif
+endif
 
 # While VLAs have been removed, GCC produces unreachable stack probes
 # for the randomize_kstack_offset feature. Disable it for all compilers.

security/Kconfig.hardening +4 -1

index 90cbaff86e13..ded17b8abce2 100644
@@ -23,13 +23,16 @@ config CC_HAS_AUTO_VAR_INIT_PATTERN
 	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
 config CC_HAS_AUTO_VAR_INIT_ZERO
+	# GCC ignores the -enable flag, so we can test for the feature with
+	# a single invocation using the flag, but drop it as appropriate in
+	# the Makefile, depending on the presence of Clang.
 	def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
 
 choice
 	prompt "Initialize kernel stack variables at function entry"
 	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
 	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
 	default INIT_STACK_NONE
 	help
 	  This option enables initialization of stack variables at

Signature · 1 line

Kees Cook

Nick Desaulniers

Reviewed-by

2021-09-14 19:22 UTC #6 lore raw

Quoted 8 lines · Kees Cook

Quoted 4 lines · Nick Desaulniers
Rather than create 2 new kconfigs with 1 new invocation of the compiler via cc-option, how about just adding an ifdef CONFIG_CC_IS_CLANG guard around adding the obnoxious flag to KBUILD_CFLAGS in the top level Makefile?
v2:

LGTM

Reviewed-by Nick Desaulniers <[email protected]>

I think the formal patch should have Will's Suggested-by on it.

Quoted 46 lines

Makefile +3 -3

index 34a0afc3a8eb..72d165ffabdb 100644
@@ -831,12 +831,12 @@ endif
 
 # Initialize all stack variables with a zero value.
 ifdef CONFIG_INIT_STACK_ALL_ZERO
-# Future support for zero initialization is still being debated, see
-# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
-# renamed or dropped.
 KBUILD_CFLAGS  += -ftrivial-auto-var-init=zero
+ifdef CONFIG_CC_IS_CLANG
+# https://bugs.llvm.org/show_bug.cgi?id=45497
 KBUILD_CFLAGS  += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
 endif
+endif
 
 # While VLAs have been removed, GCC produces unreachable stack probes
 # for the randomize_kstack_offset feature. Disable it for all compilers.

security/Kconfig.hardening +4 -2

index 90cbaff86e13..ded17b8abce2 100644
@@ -23,13 +23,16 @@ config CC_HAS_AUTO_VAR_INIT_PATTERN
        def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
 config CC_HAS_AUTO_VAR_INIT_ZERO
+       # GCC ignores the -enable flag, so we can test for the feature with
+       # a single invocation using the flag, but drop it as appropriate in
+       # the Makefile, depending on the presence of Clang.
        def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
 
 choice
        prompt "Initialize kernel stack variables at function entry"
        default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
        default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-       default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+       default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
        default INIT_STACK_NONE
        help
          This option enables initialization of stack variables at
 
--

Kees Cook

Signature · 2 lines

Thanks,
~Nick Desaulniers

Nathan Chancellor

maintainer Reviewed-by

2021-09-14 19:36 UTC #7 lore raw

In reply to Kees Cook

Quoted 7 lines · Kees Cook

Quoted 4 lines · Nick Desaulniers
Rather than create 2 new kconfigs with 1 new invocation of the compiler via cc-option, how about just adding an ifdef CONFIG_CC_IS_CLANG guard around adding the obnoxious flag to KBUILD_CFLAGS in the top level Makefile?
v2:

Thanks for clarifying! (since I did not actually test before making the comment...)

Reviewed-by Nathan Chancellor <[email protected]>

Quoted 46 lines

Makefile +3 -3

index 34a0afc3a8eb..72d165ffabdb 100644
@@ -831,12 +831,12 @@ endif
 
 # Initialize all stack variables with a zero value.
 ifdef CONFIG_INIT_STACK_ALL_ZERO
-# Future support for zero initialization is still being debated, see
-# https://bugs.llvm.org/show_bug.cgi?id=45497. These flags are subject to being
-# renamed or dropped.
 KBUILD_CFLAGS	+= -ftrivial-auto-var-init=zero
+ifdef CONFIG_CC_IS_CLANG
+# https://bugs.llvm.org/show_bug.cgi?id=45497
 KBUILD_CFLAGS	+= -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
 endif
+endif
 
 # While VLAs have been removed, GCC produces unreachable stack probes
 # for the randomize_kstack_offset feature. Disable it for all compilers.

security/Kconfig.hardening +4 -1

index 90cbaff86e13..ded17b8abce2 100644
@@ -23,13 +23,16 @@ config CC_HAS_AUTO_VAR_INIT_PATTERN
 	def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
 config CC_HAS_AUTO_VAR_INIT_ZERO
+	# GCC ignores the -enable flag, so we can test for the feature with
+	# a single invocation using the flag, but drop it as appropriate in
+	# the Makefile, depending on the presence of Clang.
 	def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
 
 choice
 	prompt "Initialize kernel stack variables at function entry"
 	default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
 	default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
-	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_PATTERN
+	default INIT_STACK_ALL_ZERO if CC_HAS_AUTO_VAR_INIT_ZERO
 	default INIT_STACK_NONE
 	help
 	  This option enables initialization of stack variables at

Signature · 2 lines

-- 
Kees Cook