Page MenuHomePhabricator

Allow using -ftrivial-auto-var-init=zero in C mode without extra flags
Needs ReviewPublic

Authored by glider on Jul 15 2019, 7:38 AM.

Details

Reviewers
jfb
Summary

Initially concerns have been raised that -ftrivial-auto-var-init=zero
potentially defines a new dialect of C++, therefore this option was
guarded with
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang.

The guard flag name suggests that at some point
-ftrivial-auto-var-init=pattern will perform on par with
-ftrivial-auto-var-init=zero, thus making it possible to remove the
latter from Clang.
However this isn't going to happen in the nearest future, at least not
on X86, where memset(object, 0, size) is still lowered to a more
efficient code than memset(object, 0xAA, size).
Therefore security-minded people may still need an easy way to
zero-initialize all the locals to keep the performance penalty low.

For Linux kernel, which already uses a non-standard dialect of C,
introducing yet another hardening feature doesn't radically change the
situation. Other C codebases also tend to use non-standard features more
often, so the mentioned guard flag only complicates the adoption of
auto-initialization for them, not actually protecting their purity.

As a compromise solution, let
-enable-trivial-auto-var-init-zero-knowing-it-will-be-removed-from-clang
remain mandatory for -ftrivial-auto-var-init=zero in C++ mode and make
it optional in the C mode.

Event Timeline

glider created this revision.Jul 15 2019, 7:38 AM
Herald added a project: Restricted Project. · View Herald TranscriptJul 15 2019, 7:38 AM
Herald added a subscriber: cfe-commits. · View Herald Transcript
glider added a reviewer: jfb.Jul 15 2019, 7:41 AM
glider added subscribers: kcc, pcc, vitalybuka and 3 others.
jfb added a comment.Jul 15 2019, 11:54 AM

A lots of folks from the original discussion insisted on this as a compromise. I'd like to make sure they see and approve of this, they might have requests for e.g. specific performance numbers.

As a data point, Linus Torvalds suggested that we need a similar feature for GCC so that the "kernel C standard" mandates zero-initialization for locals: https://lkml.org/lkml/2019/7/28/206

jfb added a comment.Jul 30 2019, 9:19 AM

As a data point, Linus Torvalds suggested that we need a similar feature for GCC so that the "kernel C standard" mandates zero-initialization for locals: https://lkml.org/lkml/2019/7/28/206

Interesting!