Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 27 Feb 2018 11:33:34 -0800
From: Kees Cook <>
To: Laura Abbott <>
Cc: P J P <>, 
	Kernel Hardening <>, Florian Weimer <>, 
	P J P <>
Subject: Re: [PATCH 1/1] Add an option to build kernel with -finit-local-vars

On Tue, Feb 27, 2018 at 11:22 AM, Laura Abbott <> wrote:
> On 02/27/2018 03:15 AM, P J P wrote:
>> Add a configuration option to build kernel with -finit-local-vars
>> compiler option.[*] It'll zero initialize the automatic kernel
>> function variables, thus helping to reduce kernel information
>> leakage issues.
> I think this would make the existing structleak plugin
> (scripts/gcc-plugins/structleak_plugin.c) obsolete. This isn't
> a bad thing but we'd need to figure out a deprecation strategy.

It would be nice to make it obsolete, but I don't think that'll happen
right away. We still have issues with structure padding,
passed-by-reference init, and possibly performance. I wouldn't want to
rule anything out until we can have both more complete coverage and
better benchmarks (e.g. this is wipe-before, not wipe-after, so there
may be cache effects, etc).


Kees Cook
Pixel Security

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.