security: allow using Clang's zero initialization for stack variables

[linux-2.6-microblaze.git] / security / Kconfig.hardening

diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening
index af4c979..269967c 100644 (file)
--- a/security/Kconfig.hardening
+++ b/security/Kconfig.hardening
@@ -19,13 +19,16 @@ config GCC_PLUGIN_STRUCTLEAK
 
 menu "Memory initialization"
 
-config CC_HAS_AUTO_VAR_INIT
+config CC_HAS_AUTO_VAR_INIT_PATTERN
        def_bool $(cc-option,-ftrivial-auto-var-init=pattern)
 
+config CC_HAS_AUTO_VAR_INIT_ZERO
+       def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang)
+
 choice
        prompt "Initialize kernel stack variables at function entry"
        default GCC_PLUGIN_STRUCTLEAK_BYREF_ALL if COMPILE_TEST && GCC_PLUGINS
-       default INIT_STACK_ALL if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT
+       default INIT_STACK_ALL_PATTERN if COMPILE_TEST && CC_HAS_AUTO_VAR_INIT_PATTERN
        default INIT_STACK_NONE
        help
          This option enables initialization of stack variables at
@@ -88,9 +91,9 @@ choice
                  of uninitialized stack variable exploits and information
                  exposures.
 
-       config INIT_STACK_ALL
+       config INIT_STACK_ALL_PATTERN
                bool "0xAA-init everything on the stack (strongest)"
-               depends on CC_HAS_AUTO_VAR_INIT
+               depends on CC_HAS_AUTO_VAR_INIT_PATTERN
                help
                  Initializes everything on the stack with a 0xAA
                  pattern. This is intended to eliminate all classes
@@ -98,6 +101,24 @@ choice
                  exposures, even variables that were warned to have been
                  left uninitialized.
 
+                 Pattern initialization is known to provoke many existing bugs
+                 related to uninitialized locals, e.g. pointers receive
+                 non-NULL values, buffer sizes and indices are very big.
+
+       config INIT_STACK_ALL_ZERO
+               bool "zero-init everything on the stack (strongest and safest)"
+               depends on CC_HAS_AUTO_VAR_INIT_ZERO
+               help
+                 Initializes everything on the stack with a zero
+                 value. This is intended to eliminate all classes
+                 of uninitialized stack variable exploits and information
+                 exposures, even variables that were warned to have been
+                 left uninitialized.
+
+                 Zero initialization provides safe defaults for strings,
+                 pointers, indices and sizes, and is therefore
+                 more suitable as a security mitigation measure.
+
 endchoice
 
 config GCC_PLUGIN_STRUCTLEAK_VERBOSE