Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 12 Mar 2018 09:22:26 +0100
From: Ingo Molnar <>
To: Linus Torvalds <>
Cc: Steven Rostedt <>, Arnd Bergmann <>,
	Ard Biesheuvel <>,
	Daniel Micay <>,
	Kees Cook <>,
	Dave Hansen <>,
	Alexander Popov <>,
	Kernel Hardening <>,
	PaX Team <>,
	Brad Spengler <>,
	Andy Lutomirski <>, Tycho Andersen <>,
	Laura Abbott <>,
	Mark Rutland <>, Borislav Petkov <>,
	Richard Sandiford <>,
	Thomas Gleixner <>,
	"H . Peter Anvin" <>,
	Peter Zijlstra <>,
	"Dmitry V . Levin" <>,
	Emese Revfy <>, Jonathan Corbet <>,
	Andrey Ryabinin <>,
	"Kirill A . Shutemov" <>,
	Thomas Garnier <>,
	Andrew Morton <>,
	Alexei Starovoitov <>, Josef Bacik <>,
	Masami Hiramatsu <>,
	Nicholas Piggin <>,
	Al Viro <>,
	"David S . Miller" <>,
	Ding Tianhong <>,
	David Woodhouse <>,
	Josh Poimboeuf <>,
	Dominik Brodowski <>,
	Juergen Gross <>,
	Greg Kroah-Hartman <>,
	Dan Williams <>,
	Mathias Krause <>,
	Vikas Shivappa <>,
	Kyle Huey <>,
	Dmitry Safonov <>,
	Will Deacon <>, X86 ML <>,
	LKML <>
Subject: Re: [PATCH RFC v9 4/7] x86/entry: Erase kernel stack in

* Linus Torvalds <> wrote:

> On Tue, Mar 6, 2018 at 1:41 PM, Linus Torvalds
> <> wrote:
> >
> > The warning would remain for the case where you don't enable this
> > hardening feature, so it wouldn't go away.
> Side note: if in ten years we'd have a minimum gcc version that we
> could  just unconditionally say "auto (scalars) initialize to zero",
> then we'd just make that be the *semantics*, and the warning would
> obviously simply not ever be an issue.

Btw., I'd suggest we initialize aggregate types to zero as well, and then work 
from there by marking exceptions via attributes.

>From what I've seen over 90% of 'tricky' initialization sequences either don't 
matter to performance, or are unnecessarily complicated.

I.e. let's eliminate VLAs and let's also make the object initialization aspect of 
the C language reliably and broadly safe by default (via a GCC plugin) with no 
exceptions, and allow an opt-in mechanism for more fragile (but faster if coded 
correctly) constructs.

Is it possible to implement this "safe automatic variable initialization" language 
feature via a GCC plugin robustly, while still keeping code generation sane? (i.e. 
no forced allocation of stack slots, etc.) It should be a superset of 

Plugin support is present in GCC version 4.5 and higher, correct? So if such a 
plugin is possible we could raise the minimum GCC version to support it 

I suspect a fair chunk of all kernel CVEs would go away if we fixed the C language 
this way.



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.