| Message ID | 20220930060624.2411883-1-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | hardening: Remove Clang's enable flag for -ftrivial-auto-var-init=zero | expand |
On Thu, Sep 29, 2022 at 11:06:24PM -0700, Kees Cook wrote: > Now that Clang's -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang > option is no longer required, remove it from the command line. Clang 16 > and later will warn when it is used, which will cause Kconfig to think > it can't use -ftrivial-auto-var-init=zero at all. Check for whether it > is required and only use it when so. > > Cc: Nathan Chancellor <nathan@kernel.org> > Cc: Masahiro Yamada <masahiroy@kernel.org> > Cc: Nick Desaulniers <ndesaulniers@google.com> > Cc: linux-kbuild@vger.kernel.org > Cc: llvm@lists.linux.dev > Cc: stable@vger.kernel.org > Fixes: f02003c860d9 ("hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO") > Signed-off-by: Kees Cook <keescook@chromium.org> Thanks for sending this change! Reviewed-by: Nathan Chancellor <nathan@kernel.org> Tested-by: Nathan Chancellor <nathan@kernel.org> Please consider getting this to Linus ASAP so that this can start filtering into stable now that the LLVM change has landed, as I lost the ability to use CONFIG_INIT_STACK_ALL_ZERO after upgrading my toolchain over the weekend :) Additionally, I am not sure the fixes tag is going to ensure that this change automatically makes it back to 5.15 and 5.10, which have commit f0fe00d4972a ("security: allow using Clang's zero initialization for stack variables") but not commit f02003c860d9 ("hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO"). I guess if I am reading the stable documentation right, we could do something like: Cc: stable@vger.kernel.org # dcb7c0b9461c + f02003c860d9 Fixes: f0fe00d4972a ("security: allow using Clang's zero initialization for stack variables") but I am not sure. I guess we can always just send manual backports once it is merged. > --- > Makefile | 4 ++-- > security/Kconfig.hardening | 14 ++++++++++---- > 2 files changed, 12 insertions(+), 6 deletions(-) > > diff --git a/Makefile b/Makefile > index c7705f749601..02c857e2243c 100644 > --- a/Makefile > +++ b/Makefile > @@ -831,8 +831,8 @@ endif > # Initialize all stack variables with a zero value. > ifdef CONFIG_INIT_STACK_ALL_ZERO > KBUILD_CFLAGS += -ftrivial-auto-var-init=zero > -ifdef CONFIG_CC_IS_CLANG > -# https://bugs.llvm.org/show_bug.cgi?id=45497 > +ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER > +# https://github.com/llvm/llvm-project/issues/44842 > KBUILD_CFLAGS += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang > endif > endif > diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening > index bd2aabb2c60f..995bc42003e6 100644 > --- a/security/Kconfig.hardening > +++ b/security/Kconfig.hardening > @@ -22,11 +22,17 @@ menu "Memory initialization" > config CC_HAS_AUTO_VAR_INIT_PATTERN > def_bool $(cc-option,-ftrivial-auto-var-init=pattern) > > -config CC_HAS_AUTO_VAR_INIT_ZERO > - # GCC ignores the -enable flag, so we can test for the feature with > - # a single invocation using the flag, but drop it as appropriate in > - # the Makefile, depending on the presence of Clang. > +config CC_HAS_AUTO_VAR_INIT_ZERO_BARE > + def_bool $(cc-option,-ftrivial-auto-var-init=zero) > + > +config CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER > + # Clang 16 and later warn about using the -enable flag, but it > + # is required before then. > def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) > + depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE > + > +config CC_HAS_AUTO_VAR_INIT_ZERO > + def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER > > choice > prompt "Initialize kernel stack variables at function entry" > -- > 2.34.1 >
On Mon, Oct 03, 2022 at 09:41:19AM -0700, Nathan Chancellor wrote: > On Thu, Sep 29, 2022 at 11:06:24PM -0700, Kees Cook wrote: > > Now that Clang's -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang > > option is no longer required, remove it from the command line. Clang 16 > > and later will warn when it is used, which will cause Kconfig to think > > it can't use -ftrivial-auto-var-init=zero at all. Check for whether it > > is required and only use it when so. > > > > Cc: Nathan Chancellor <nathan@kernel.org> > > Cc: Masahiro Yamada <masahiroy@kernel.org> > > Cc: Nick Desaulniers <ndesaulniers@google.com> > > Cc: linux-kbuild@vger.kernel.org > > Cc: llvm@lists.linux.dev > > Cc: stable@vger.kernel.org > > Fixes: f02003c860d9 ("hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO") > > Signed-off-by: Kees Cook <keescook@chromium.org> > > Thanks for sending this change! > > Reviewed-by: Nathan Chancellor <nathan@kernel.org> > Tested-by: Nathan Chancellor <nathan@kernel.org> Thanks! > > Please consider getting this to Linus ASAP so that this can start > filtering into stable now that the LLVM change has landed, as I lost the > ability to use CONFIG_INIT_STACK_ALL_ZERO after upgrading my toolchain > over the weekend :) Yup -- it's in my PR for the hardening tree sent on Saturday. > Additionally, I am not sure the fixes tag is going to ensure that this > change automatically makes it back to 5.15 and 5.10, which have > commit f0fe00d4972a ("security: allow using Clang's zero initialization > for stack variables") but not commit f02003c860d9 ("hardening: Avoid > harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO"). I guess if I > am reading the stable documentation right, we could do something like: > > Cc: stable@vger.kernel.org # dcb7c0b9461c + f02003c860d9 > Fixes: f0fe00d4972a ("security: allow using Clang's zero initialization for stack variables") > > but I am not sure. I guess we can always just send manual backports > once it is merged. Ah, good point. Yeah, probably just do backports of f02003c860d9 and this one.
diff --git a/Makefile b/Makefile index c7705f749601..02c857e2243c 100644 --- a/Makefile +++ b/Makefile @@ -831,8 +831,8 @@ endif # Initialize all stack variables with a zero value. ifdef CONFIG_INIT_STACK_ALL_ZERO KBUILD_CFLAGS += -ftrivial-auto-var-init=zero -ifdef CONFIG_CC_IS_CLANG -# https://bugs.llvm.org/show_bug.cgi?id=45497 +ifdef CONFIG_CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER +# https://github.com/llvm/llvm-project/issues/44842 KBUILD_CFLAGS += -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang endif endif diff --git a/security/Kconfig.hardening b/security/Kconfig.hardening index bd2aabb2c60f..995bc42003e6 100644 --- a/security/Kconfig.hardening +++ b/security/Kconfig.hardening @@ -22,11 +22,17 @@ menu "Memory initialization" config CC_HAS_AUTO_VAR_INIT_PATTERN def_bool $(cc-option,-ftrivial-auto-var-init=pattern) -config CC_HAS_AUTO_VAR_INIT_ZERO - # GCC ignores the -enable flag, so we can test for the feature with - # a single invocation using the flag, but drop it as appropriate in - # the Makefile, depending on the presence of Clang. +config CC_HAS_AUTO_VAR_INIT_ZERO_BARE + def_bool $(cc-option,-ftrivial-auto-var-init=zero) + +config CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER + # Clang 16 and later warn about using the -enable flag, but it + # is required before then. def_bool $(cc-option,-ftrivial-auto-var-init=zero -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang) + depends on !CC_HAS_AUTO_VAR_INIT_ZERO_BARE + +config CC_HAS_AUTO_VAR_INIT_ZERO + def_bool CC_HAS_AUTO_VAR_INIT_ZERO_BARE || CC_HAS_AUTO_VAR_INIT_ZERO_ENABLER choice prompt "Initialize kernel stack variables at function entry"
Now that Clang's -enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang option is no longer required, remove it from the command line. Clang 16 and later will warn when it is used, which will cause Kconfig to think it can't use -ftrivial-auto-var-init=zero at all. Check for whether it is required and only use it when so. Cc: Nathan Chancellor <nathan@kernel.org> Cc: Masahiro Yamada <masahiroy@kernel.org> Cc: Nick Desaulniers <ndesaulniers@google.com> Cc: linux-kbuild@vger.kernel.org Cc: llvm@lists.linux.dev Cc: stable@vger.kernel.org Fixes: f02003c860d9 ("hardening: Avoid harmless Clang option under CONFIG_INIT_STACK_ALL_ZERO") Signed-off-by: Kees Cook <keescook@chromium.org> --- Makefile | 4 ++-- security/Kconfig.hardening | 14 ++++++++++---- 2 files changed, 12 insertions(+), 6 deletions(-)