Messages in this thread | | | From | Maciej Żenczykowski <> | Date | Tue, 16 Jun 2020 01:41:31 -0700 | Subject | Re: [PATCH v2] [RFC] security: allow using Clang's zero initialization for stack variables |
| |
> In addition to -ftrivial-auto-var-init=pattern (used by > CONFIG_INIT_STACK_ALL now) Clang also supports zero initialization for > locals enabled by -ftrivial-auto-var-init=zero. > The future of this flag is still being debated, see > https://bugs.llvm.org/show_bug.cgi?id=45497 > Right now it is guarded by another flag, > -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang, > which means it may not be supported by future Clang releases. > Another possible resolution is that -ftrivial-auto-var-init=zero will > persist (as certain users have already started depending on it), but the > name of the guard flag will change. > > In the meantime, zero initialization has proven itself as a good > production mitigation measure against uninitialized locals. Unlike > pattern initialization, which has a higher chance of triggering existing > bugs, zero initialization provides safe defaults for strings, pointers, > indexes, and sizes. On the other hand, pattern initialization remains > safer for return values. > Performance-wise, the difference between pattern and zero initialization > is usually negligible, although the generated code for zero > initialization is more compact. > > This patch renames CONFIG_INIT_STACK_ALL to > CONFIG_INIT_STACK_ALL_PATTERN and introduces another config option, > CONFIG_INIT_STACK_ALL_ZERO, that enables zero initialization for locals > if the corresponding flags are supported by Clang.
I'm a great fan of zero initialization as opposed to pattern. I don't understand why clang is refusing to make this a supported option.
Anyway:
Reviewed-by: Maciej Żenczykowski <maze@google.com>
| |