kernel: Enable -fstack-protector-strong

[markj]

Summary

This extends stack canary use to all functions which perform operations
on arrays, not just those which operate on byte buffers.

Test Plan

I ran will-it-scale on a 16-core ryzen 7950X3D (hyperthreading enabled, will disable it if I do another run): https://people.freebsd.org/~markj/stack-protector-strong/will-it-scale2.html

The results aren't very conclusive. (will-it-scale also isn't a great test for this, but it's convenient and I have some scripts for it.) The stack-protector option changes the kernel's .text layout and I suspect that the small differences observed in the benchmark are a result of that rather than direct overhead of the option itself. In particular:

   text    data     bss     dec     hex filename
21042932        1756749 8728192 31527873        1e113c1 /boot/kernel.no-stack-protector/kernel
21142484        1756749 8728192 31627425        1e298a1 /boot/kernel.stack-protector/kernel
21485116        1756749 8728192 31970057        1e7d309 /boot/kernel.stack-protector-strong/kernel

and across the benchmarks there's no consistent "winner". I wouldn't expect the kernel to matter at all for the malloc 1KB benchmarks for instance, as there are no system calls happening.

With -fstack-protector-strong something like ~9000 functions in the kernel are covered, versus ~1500 by default. (This isn't counting kernel modules.)

[olivier]

No performance impact (CPU usage increase) for our use case

[olce]

Great!