From: Kees Cook Date: Thu, 17 Jul 2025 23:25:18 +0000 (-0700) Subject: configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=437641a72d0a675242ae3e649a30b4c51b3ad450;p=thirdparty%2Fkernel%2Flinux.git configs/hardening: Enable CONFIG_INIT_ON_FREE_DEFAULT_ON To reduce stale data lifetimes, enable CONFIG_INIT_ON_FREE_DEFAULT_ON as well. This matches the addition of CONFIG_STACKLEAK=y, which is doing similar for stack memory. Link: https://lore.kernel.org/r/20250717232519.2984886-13-kees@kernel.org Signed-off-by: Kees Cook --- diff --git a/kernel/configs/hardening.config b/kernel/configs/hardening.config index d24c2772d04d7..64caaf997fc08 100644 --- a/kernel/configs/hardening.config +++ b/kernel/configs/hardening.config @@ -60,6 +60,9 @@ CONFIG_LIST_HARDENED=y # Initialize all heap variables to zero on allocation. CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y +# Initialize all heap variables to zero on free to reduce stale data lifetime. +CONFIG_INIT_ON_FREE_DEFAULT_ON=y + # Initialize all stack variables to zero on function entry. CONFIG_INIT_STACK_ALL_ZERO=y