Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20200616083435.223038-1-glider@google.com> <20200616100309.GA2614426@kroah.com>
In-Reply-To: <20200616100309.GA2614426@kroah.com>
From:   Alexander Potapenko <glider@google.com>
Date:   Tue, 16 Jun 2020 14:15:52 +0200
Message-ID: <CAG_fn=VYN6ynu2bnW96-p-QRi77NstHC6DXS+AN0r0bm5K2j7w@mail.gmail.com>
Subject: Re: [PATCH v2] [RFC] security: allow using Clang's zero
 initialization for stack variables
To:     Greg KH <gregkh@linuxfoundation.org>
Cc:     Masahiro Yamada <yamada.masahiro@socionext.com>,
        Kees Cook <keescook@chromium.org>,
        James Morris <jmorris@namei.org>,
        =?UTF-8?Q?Maciej_=C5=BBenczykowski?= <maze@google.com>,
        Nick Desaulniers <ndesaulniers@google.com>,
        linux-security-module <linux-security-module@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

> > +KBUILD_CFLAGS        += -ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
> > +endif
>
> Gotta love the name...

This is basically the reason why we've been hesitating to add it to
the kernel from the very beginning.

> Anyway, if this is enabled, and clang changes the flag or drops it, does
> the build suddenly break?

My original intention (see v1 of this patch) was to make
zero-initialization a secondary option of INIT_STACK_ALL, so that
nothing changes for the existing users.
But I agree with Kees that these options should be made distinct, as
people may want to use them for different purposes (think debug vs.
release builds).

We could make INIT_STACK_ALL_ZERO fall back to INIT_STACK_ALL_PATTERN
if the compiler flag goes away - does this make sense?

> And does gcc have something like this as well, or does that have to come
> in a compiler plugin?

Kees mentioned someone's plans to implement that in GCC, but I don't
think they have done it already.