All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <kees@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Kees Cook <kees@kernel.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	linux-hardening@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
	Marco Elver <elver@google.com>,
	Andrey Konovalov <andreyknvl@gmail.com>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Ard Biesheuvel <ardb@kernel.org>,
	Masahiro Yamada <masahiroy@kernel.org>,
	Nathan Chancellor <nathan@kernel.org>,
	Nicolas Schier <nicolas.schier@linux.dev>,
	Nick Desaulniers <nick.desaulniers+lkml@gmail.com>,
	Bill Wendling <morbo@google.com>,
	Justin Stitt <justinstitt@google.com>,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	kasan-dev@googlegroups.com, linux-doc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
	linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org,
	linux-efi@vger.kernel.org, linux-kbuild@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org, sparclinux@vger.kernel.org,
	llvm@lists.linux.dev
Subject: [PATCH v2 13/14] configs/hardening: Enable CONFIG_KSTACK_ERASE
Date: Thu, 22 May 2025 21:39:23 -0700	[thread overview]
Message-ID: <20250523043935.2009972-13-kees@kernel.org> (raw)
In-Reply-To: <20250523043251.it.550-kees@kernel.org>

Since we can wipe the stack with both Clang and GCC plugins, enable this
for the "hardening.config" for wider testing.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: <linux-hardening@vger.kernel.org>
---
 kernel/configs/hardening.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index dd7c32fb5ac1..d24c2772d04d 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
 # Initialize all stack variables to zero on function entry.
 CONFIG_INIT_STACK_ALL_ZERO=y
 
+# Wipe kernel stack after syscall completion to reduce stale data lifetime.
+CONFIG_KSTACK_ERASE=y
+
 # Wipe RAM at reboot via EFI. For more details, see:
 # https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/
 # https://bugzilla.redhat.com/show_bug.cgi?id=1532058
-- 
2.34.1


WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <kees@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Kees Cook <kees@kernel.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	linux-hardening@vger.kernel.org, Christoph Hellwig <hch@lst.de>,
	Marco Elver <elver@google.com>,
	Andrey Konovalov <andreyknvl@gmail.com>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Ard Biesheuvel <ardb@kernel.org>,
	Masahiro Yamada <masahiroy@kernel.org>,
	Nathan Chancellor <nathan@kernel.org>,
	Nicolas Schier <nicolas.schier@linux.dev>,
	Nick Desaulniers <nick.desaulniers+lkml@gmail.com>,
	Bill Wendling <morbo@google.com>,
	Justin Stitt <justinstitt@google.com>,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	kasan-dev@googlegroups.com, linux-doc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
	linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org,
	linux-efi@vger.kernel.org, linux-kbuild@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org, sparclinux@vger.kernel.org,
	llvm@lists.linux.dev
Subject: [PATCH v2 13/14] configs/hardening: Enable CONFIG_KSTACK_ERASE
Date: Thu, 22 May 2025 21:39:23 -0700	[thread overview]
Message-ID: <20250523043935.2009972-13-kees@kernel.org> (raw)
In-Reply-To: <20250523043251.it.550-kees@kernel.org>

Since we can wipe the stack with both Clang and GCC plugins, enable this
for the "hardening.config" for wider testing.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: <linux-hardening@vger.kernel.org>
---
 kernel/configs/hardening.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index dd7c32fb5ac1..d24c2772d04d 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -63,6 +63,9 @@ CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
 # Initialize all stack variables to zero on function entry.
 CONFIG_INIT_STACK_ALL_ZERO=y
 
+# Wipe kernel stack after syscall completion to reduce stale data lifetime.
+CONFIG_KSTACK_ERASE=y
+
 # Wipe RAM at reboot via EFI. For more details, see:
 # https://trustedcomputinggroup.org/resource/pc-client-work-group-platform-reset-attack-mitigation-specification/
 # https://bugzilla.redhat.com/show_bug.cgi?id=1532058
-- 
2.34.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

  parent reply	other threads:[~2025-05-23  4:39 UTC|newest]

Thread overview: 58+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-05-23  4:39 [PATCH v2 00/14] stackleak: Support Clang stack depth tracking Kees Cook
2025-05-23  4:39 ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 01/14] stackleak: Rename STACKLEAK to KSTACK_ERASE Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 02/14] stackleak: Rename stackleak_track_stack to __sanitizer_cov_stack_depth Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 03/14] stackleak: Split KSTACK_ERASE_CFLAGS from GCC_PLUGINS_CFLAGS Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 04/14] x86: Handle KCOV __init vs inline mismatches Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23 14:35   ` Sean Christopherson
2025-05-23 14:35     ` Sean Christopherson
2025-05-23 20:28     ` Kees Cook
2025-05-23 20:28       ` Kees Cook
2025-05-25 21:53   ` Ilpo Järvinen
2025-05-25 21:53     ` Ilpo Järvinen
2025-05-27  3:30     ` Kees Cook
2025-05-27  3:30       ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 05/14] arm: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23 11:19   ` Nishanth Menon
2025-05-23 11:19     ` Nishanth Menon
2025-05-23  4:39 ` [PATCH v2 06/14] arm64: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 07/14] s390: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  9:35   ` Heiko Carstens
2025-05-23  9:35     ` Heiko Carstens
2025-05-23  4:39 ` [PATCH v2 08/14] powerpc: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  5:24   ` Andrew Donnellan
2025-05-23  5:24     ` Andrew Donnellan
2025-05-23 15:15     ` Kees Cook
2025-05-23 15:15       ` Kees Cook
2025-05-24 10:43   ` Ritesh Harjani
2025-05-24 10:43     ` Ritesh Harjani
2025-07-10  1:57     ` Kees Cook
2025-07-10  1:57       ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 09/14] mips: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-06-19  8:55   ` Huacai Chen
2025-06-19  8:55     ` Huacai Chen
2025-05-23  4:39 ` [PATCH v2 10/14] loongarch: " Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-06-19  8:55   ` Huacai Chen
2025-06-19  8:55     ` Huacai Chen
2025-06-24 12:31     ` Huacai Chen
2025-06-24 12:31       ` Huacai Chen
2025-06-25  1:09       ` Kees Cook
2025-06-25  1:09         ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 11/14] init.h: Disable sanitizer coverage for __init and __head Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` [PATCH v2 12/14] kstack_erase: Support Clang stack depth tracking Kees Cook
2025-05-23  4:39   ` Kees Cook
2025-05-23  4:39 ` Kees Cook [this message]
2025-05-23  4:39   ` [PATCH v2 13/14] configs/hardening: Enable CONFIG_KSTACK_ERASE Kees Cook
2025-05-23  4:39 ` [PATCH v2 14/14] configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON Kees Cook
2025-05-23  4:39   ` Kees Cook

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250523043935.2009972-13-kees@kernel.org \
    --to=kees@kernel.org \
    --cc=andreyknvl@gmail.com \
    --cc=ardb@kernel.org \
    --cc=arnd@arndb.de \
    --cc=elver@google.com \
    --cc=gustavoars@kernel.org \
    --cc=hch@lst.de \
    --cc=justinstitt@google.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=kvmarm@lists.linux.dev \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kbuild@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=masahiroy@kernel.org \
    --cc=morbo@google.com \
    --cc=nathan@kernel.org \
    --cc=nick.desaulniers+lkml@gmail.com \
    --cc=nicolas.schier@linux.dev \
    --cc=ryabinin.a.a@gmail.com \
    --cc=sparclinux@vger.kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.