Messages in this thread | | | Date | Thu, 5 Mar 2020 11:07:56 +0300 | From | Dan Carpenter <> | Subject | Re: [PATCH v2 2/3] binder: do not initialize locals passed to copy_from_user() |
| |
On Wed, Mar 04, 2020 at 10:13:40AM -0800, Kees Cook wrote: > On Tue, Mar 03, 2020 at 12:38:32PM +0300, Dan Carpenter wrote: > > The real fix is to initialize everything manually, the automated > > initialization is a hardenning feature which many people will disable. > > I cannot disagree more with this sentiment. Linus has specifically said he > wants this initialization on by default[1],
Fine, but as long as it's a configurable thing then we need to manually initialize as well or it's still a CVE etc. It will take a while before we drop support for old versions of GCC as well.
regards, dan carpenter
| |