All of lore.kernel.org
 help / color / mirror / Atom feed
From: Kees Cook <kees@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Kees Cook <kees@kernel.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	linux-hardening@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Christoph Hellwig <hch@lst.de>,
	Andrey Konovalov <andreyknvl@gmail.com>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Ard Biesheuvel <ardb@kernel.org>,
	Masahiro Yamada <masahiroy@kernel.org>,
	Nathan Chancellor <nathan@kernel.org>,
	Nicolas Schier <nicolas.schier@linux.dev>,
	Nick Desaulniers <nick.desaulniers+lkml@gmail.com>,
	Bill Wendling <morbo@google.com>,
	Justin Stitt <justinstitt@google.com>,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	kasan-dev@googlegroups.com, linux-doc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
	linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org,
	linux-efi@vger.kernel.org, linux-kbuild@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org, sparclinux@vger.kernel.org,
	llvm@lists.linux.dev
Subject: [PATCH v3 13/13] configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON
Date: Thu, 17 Jul 2025 16:25:18 -0700	[thread overview]
Message-ID: <20250717232519.2984886-13-kees@kernel.org> (raw)
In-Reply-To: <20250717231756.make.423-kees@kernel.org>

To reduce stale data lifetimes, enable CONFIG_INIT_ON_FREE_DEFAULT_ON as
well. This matches the addition of CONFIG_STACKLEAK=y, which is doing
similar for stack memory.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: <linux-hardening@vger.kernel.org>
---
 kernel/configs/hardening.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index d24c2772d04d..64caaf997fc0 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -60,6 +60,9 @@ CONFIG_LIST_HARDENED=y
 # Initialize all heap variables to zero on allocation.
 CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
 
+# Initialize all heap variables to zero on free to reduce stale data lifetime.
+CONFIG_INIT_ON_FREE_DEFAULT_ON=y
+
 # Initialize all stack variables to zero on function entry.
 CONFIG_INIT_STACK_ALL_ZERO=y
 
-- 
2.34.1


WARNING: multiple messages have this Message-ID (diff)
From: Kees Cook <kees@kernel.org>
To: Arnd Bergmann <arnd@arndb.de>
Cc: Kees Cook <kees@kernel.org>,
	"Gustavo A. R. Silva" <gustavoars@kernel.org>,
	linux-hardening@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Christoph Hellwig <hch@lst.de>,
	Andrey Konovalov <andreyknvl@gmail.com>,
	Andrey Ryabinin <ryabinin.a.a@gmail.com>,
	Ard Biesheuvel <ardb@kernel.org>,
	Masahiro Yamada <masahiroy@kernel.org>,
	Nathan Chancellor <nathan@kernel.org>,
	Nicolas Schier <nicolas.schier@linux.dev>,
	Nick Desaulniers <nick.desaulniers+lkml@gmail.com>,
	Bill Wendling <morbo@google.com>,
	Justin Stitt <justinstitt@google.com>,
	linux-kernel@vger.kernel.org, x86@kernel.org,
	kasan-dev@googlegroups.com, linux-doc@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
	linux-riscv@lists.infradead.org, linux-s390@vger.kernel.org,
	linux-efi@vger.kernel.org, linux-kbuild@vger.kernel.org,
	linux-security-module@vger.kernel.org,
	linux-kselftest@vger.kernel.org, sparclinux@vger.kernel.org,
	llvm@lists.linux.dev
Subject: [PATCH v3 13/13] configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON
Date: Thu, 17 Jul 2025 16:25:18 -0700	[thread overview]
Message-ID: <20250717232519.2984886-13-kees@kernel.org> (raw)
In-Reply-To: <20250717231756.make.423-kees@kernel.org>

To reduce stale data lifetimes, enable CONFIG_INIT_ON_FREE_DEFAULT_ON as
well. This matches the addition of CONFIG_STACKLEAK=y, which is doing
similar for stack memory.

Signed-off-by: Kees Cook <kees@kernel.org>
---
Cc: "Gustavo A. R. Silva" <gustavoars@kernel.org>
Cc: <linux-hardening@vger.kernel.org>
---
 kernel/configs/hardening.config | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config
index d24c2772d04d..64caaf997fc0 100644
--- a/kernel/configs/hardening.config
+++ b/kernel/configs/hardening.config
@@ -60,6 +60,9 @@ CONFIG_LIST_HARDENED=y
 # Initialize all heap variables to zero on allocation.
 CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
 
+# Initialize all heap variables to zero on free to reduce stale data lifetime.
+CONFIG_INIT_ON_FREE_DEFAULT_ON=y
+
 # Initialize all stack variables to zero on function entry.
 CONFIG_INIT_STACK_ALL_ZERO=y
 
-- 
2.34.1


_______________________________________________
linux-riscv mailing list
linux-riscv@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-riscv

  parent reply	other threads:[~2025-07-17 23:25 UTC|newest]

Thread overview: 62+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-07-17 23:25 [PATCH v3 00/13] stackleak: Support Clang stack depth tracking Kees Cook
2025-07-17 23:25 ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 01/13] stackleak: Rename STACKLEAK to KSTACK_ERASE Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-21 20:02   ` Nicolas Schier
2025-07-21 20:02     ` Nicolas Schier
2025-07-21 20:16     ` Kees Cook
2025-07-21 20:16       ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 02/13] stackleak: Rename stackleak_track_stack to __sanitizer_cov_stack_depth Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 03/13] stackleak: Split KSTACK_ERASE_CFLAGS from GCC_PLUGINS_CFLAGS Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 04/13] x86: Handle KCOV __init vs inline mismatches Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-18  8:36   ` Mike Rapoport
2025-07-18  8:36     ` Mike Rapoport
2025-07-18 22:51     ` Kees Cook
2025-07-18 22:51       ` Kees Cook
2025-07-20  6:10       ` Ard Biesheuvel
2025-07-20  6:10         ` Ard Biesheuvel
2025-07-21 12:47         ` Will Deacon
2025-07-21 12:47           ` Will Deacon
2025-07-21 20:14           ` Kees Cook
2025-07-21 20:14             ` Kees Cook
2025-07-21 20:49             ` Kees Cook
2025-07-21 20:49               ` Kees Cook
2025-07-22  6:55               ` Ard Biesheuvel
2025-07-22  6:55                 ` Ard Biesheuvel
2025-07-22 13:29                 ` Will Deacon
2025-07-22 13:29                   ` Will Deacon
2025-07-22  8:26       ` Mike Rapoport
2025-07-22  8:26         ` Mike Rapoport
2025-07-17 23:25 ` [PATCH v3 05/13] arm: " Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-18 12:58   ` Nishanth Menon
2025-07-18 12:58     ` Nishanth Menon
2025-07-18 13:04   ` Lee Jones
2025-07-18 13:04     ` Lee Jones
2025-07-17 23:25 ` [PATCH v3 06/13] arm64: " Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-18 11:22   ` Will Deacon
2025-07-18 11:22     ` Will Deacon
2025-07-17 23:25 ` [PATCH v3 07/13] s390: " Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 08/13] powerpc/mm/book3s64: Move kfence and debug_pagealloc related calls to __init section Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 09/13] mips: Handle KCOV __init vs inline mismatch Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-18  9:18   ` Huacai Chen
2025-07-18  9:18     ` Huacai Chen
2025-07-17 23:25 ` [PATCH v3 10/13] init.h: Disable sanitizer coverage for __init and __head Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-18 22:51   ` kernel test robot
2025-07-19  4:22   ` kernel test robot
2025-07-17 23:25 ` [PATCH v3 11/13] kstack_erase: Support Clang stack depth tracking Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` [PATCH v3 12/13] configs/hardening: Enable CONFIG_KSTACK_ERASE Kees Cook
2025-07-17 23:25   ` Kees Cook
2025-07-17 23:25 ` Kees Cook [this message]
2025-07-17 23:25   ` [PATCH v3 13/13] configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON Kees Cook
2025-08-10 21:12 ` [PATCH v3 00/13] stackleak: Support Clang stack depth tracking patchwork-bot+linux-riscv
2025-08-10 21:12   ` patchwork-bot+linux-riscv

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20250717232519.2984886-13-kees@kernel.org \
    --to=kees@kernel.org \
    --cc=andreyknvl@gmail.com \
    --cc=ardb@kernel.org \
    --cc=arnd@arndb.de \
    --cc=gustavoars@kernel.org \
    --cc=hch@lst.de \
    --cc=justinstitt@google.com \
    --cc=kasan-dev@googlegroups.com \
    --cc=kvmarm@lists.linux.dev \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-doc@vger.kernel.org \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-hardening@vger.kernel.org \
    --cc=linux-kbuild@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-kselftest@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=linux-s390@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=llvm@lists.linux.dev \
    --cc=masahiroy@kernel.org \
    --cc=mingo@kernel.org \
    --cc=morbo@google.com \
    --cc=nathan@kernel.org \
    --cc=nick.desaulniers+lkml@gmail.com \
    --cc=nicolas.schier@linux.dev \
    --cc=ryabinin.a.a@gmail.com \
    --cc=sparclinux@vger.kernel.org \
    --cc=x86@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.