diff options
| author | Kees Cook <kees@kernel.org> | 2025-07-17 16:25:18 -0700 |
|---|---|---|
| committer | Kees Cook <kees@kernel.org> | 2025-07-21 21:41:57 -0700 |
| commit | 437641a72d0a675242ae3e649a30b4c51b3ad450 (patch) | |
| tree | 840f26059125b322b5e852e6d6e6296e0a70186f | |
| parent | 4c56d9f7e75eb2a137584f708fa262d7e8c8a2d8 (diff) | |
configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON
To reduce stale data lifetimes, enable CONFIG_INIT_ON_FREE_DEFAULT_ON as
well. This matches the addition of CONFIG_STACKLEAK=y, which is doing
similar for stack memory.
Link: https://lore.kernel.org/r/20250717232519.2984886-13-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
| -rw-r--r-- | kernel/configs/hardening.config | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config index d24c2772d04d..64caaf997fc0 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -60,6 +60,9 @@ CONFIG_LIST_HARDENED=y # Initialize all heap variables to zero on allocation. CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +# Initialize all heap variables to zero on free to reduce stale data lifetime. +CONFIG_INIT_ON_FREE_DEFAULT_ON=y + # Initialize all stack variables to zero on function entry. CONFIG_INIT_STACK_ALL_ZERO=y |