From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ARC-Seal: i=1; a=rsa-sha256; t=1520842950; cv=none; d=google.com; s=arc-20160816; b=Hpty3qckcEQDNHtjQMLHdfaTblSgM4qd2HM3YiNpiUrm7DAy3trC0LbU0qJF04Z3iH 9Dlt32t9oLeIR9j9opldLobVwPm0t7GFJU89wIjVWGTnYFSKeGs+gEgXiRlB9t/OmgRq cVtZ6BXtdWxeCkGaj36ZH2SsJwlACtuVRQ8GyR4A9uNmHzBTeNgGbNdGaqw+omgcQ6Ux EmoTMmSAxlyTSs3kWlL/vLlqDbWEMt/2RLJOgr7OLF9I7vOlPTEayNmEPzCeLGmk2Ucy ++AvEHP/0hg0+WW559tp9A/oJJK0hUolRq1aWmYRewbPkwB9eg3lz5lxvf+2xx/bdK6i 3tZQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=user-agent:in-reply-to:content-disposition:mime-version:references :message-id:subject:cc:to:from:date:sender:dkim-signature :arc-authentication-results; bh=ChrSk79yj12AnuF/rBGvLj44LUIWr7p8dIBGs2JSvP4=; b=b9maXpWxKAEdPLGFa5CZwikJRZlE7ZmKKPHLEKSrMwiXpaQFuKJ6eaJSMOH3uNvt+3 PIWmacUiaUl2pm5bfRBHCpZzHwznuvJX7J5f1tZBr4gAAdt/CldKXbp9GYqUgafrjf/E fgEgKv/Uk7Zp8aUNriL/iiOsV8qcWPyL0zRzLLlOtlrUny0x4PkIoDhlKvL0l1IspuWb GWVyiUU4pabqi62297g3ckBC5MO9b5haq0Ytj37uwSHxnXvrJKGTFVYrXauqo2BKxZeu lGHIpENfeyFFE+DzGmzIHgjcVUiPiI3+iuHdbO7KM0CAlJR/GyKFNQMc7+k0QUFdA4yt kTiQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=crpwcj9y; spf=pass (google.com: domain of mingo.kernel.org@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=mingo.kernel.org@gmail.com Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=crpwcj9y; spf=pass (google.com: domain of mingo.kernel.org@gmail.com designates 209.85.220.65 as permitted sender) smtp.mailfrom=mingo.kernel.org@gmail.com X-Google-Smtp-Source: AG47ELsvtmD7MgupZvlkuUF9IsyNPizAQA28IF5bx66EahRMmQDb8LNX1L/ad6p8ZJUWowzzclFshA== Sender: Ingo Molnar Date: Mon, 12 Mar 2018 09:22:26 +0100 From: Ingo Molnar To: Linus Torvalds Cc: Steven Rostedt , Arnd Bergmann , Ard Biesheuvel , Daniel Micay , Kees Cook , Dave Hansen , Alexander Popov , Kernel Hardening , PaX Team , Brad Spengler , Andy Lutomirski , Tycho Andersen , Laura Abbott , Mark Rutland , Borislav Petkov , Richard Sandiford , Thomas Gleixner , "H . Peter Anvin" , Peter Zijlstra , "Dmitry V . Levin" , Emese Revfy , Jonathan Corbet , Andrey Ryabinin , "Kirill A . Shutemov" , Thomas Garnier , Andrew Morton , Alexei Starovoitov , Josef Bacik , Masami Hiramatsu , Nicholas Piggin , Al Viro , "David S . Miller" , Ding Tianhong , David Woodhouse , Josh Poimboeuf , Dominik Brodowski , Juergen Gross , Greg Kroah-Hartman , Dan Williams , Mathias Krause , Vikas Shivappa , Kyle Huey , Dmitry Safonov , Will Deacon , X86 ML , LKML Subject: Re: [PATCH RFC v9 4/7] x86/entry: Erase kernel stack in syscall_trace_enter() Message-ID: <20180312082226.ciggxv37cgcazs3j@gmail.com> References: <20180306080855.phtgl2bzqm5hnthu@gmail.com> <20180306163616.7e3b6e0e@vmware.local.home> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: NeoMutt/20170609 (1.8.3) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: =?utf-8?q?1593947986518331727?= X-GMAIL-MSGID: =?utf-8?q?1594719418310411853?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: * Linus Torvalds wrote: > On Tue, Mar 6, 2018 at 1:41 PM, Linus Torvalds > wrote: > > > > The warning would remain for the case where you don't enable this > > hardening feature, so it wouldn't go away. > > Side note: if in ten years we'd have a minimum gcc version that we > could just unconditionally say "auto (scalars) initialize to zero", > then we'd just make that be the *semantics*, and the warning would > obviously simply not ever be an issue. Btw., I'd suggest we initialize aggregate types to zero as well, and then work from there by marking exceptions via attributes. >>From what I've seen over 90% of 'tricky' initialization sequences either don't matter to performance, or are unnecessarily complicated. I.e. let's eliminate VLAs and let's also make the object initialization aspect of the C language reliably and broadly safe by default (via a GCC plugin) with no exceptions, and allow an opt-in mechanism for more fragile (but faster if coded correctly) constructs. Is it possible to implement this "safe automatic variable initialization" language feature via a GCC plugin robustly, while still keeping code generation sane? (i.e. no forced allocation of stack slots, etc.) It should be a superset of CONFIG_GCC_PLUGIN_STRUCTLEAK=y. Plugin support is present in GCC version 4.5 and higher, correct? So if such a plugin is possible we could raise the minimum GCC version to support it unconditionally. I suspect a fair chunk of all kernel CVEs would go away if we fixed the C language this way. Thanks, Ingo