linux-kernel - Re: [PATCH 3.12 69/76] net: fix infoleak in rtnetlink

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 20 May 2016 16:49:52 +0200
From:	Vegard Nossum <vegard.nossum@...il.com>
To:	Kangjie Lu <kangjielu@...il.com>
Cc:	Jiri Slaby <jslaby@...e.cz>, stable <stable@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Kangjie Lu <kjlu@...ech.edu>,
	"David S . Miller" <davem@...emloft.net>
Subject: Re: [PATCH 3.12 69/76] net: fix infoleak in rtnetlink

On 20 May 2016 at 16:35, Kangjie Lu <kangjielu@...il.com> wrote:
>> > Yes or no.  According to my experiences, it depends on how
>> > it is initialized:
>> > if there are no variables but all constants in the bracket,
>> > a global initializer will be generated, which will zero the remaining
>> > bytes
>> > including padding; otherwise, no global initializer
>> > will be used, hence the remaining bytes are not initialized.
>> > In this case, dev is not a constant, so no global initializer
>> > will be used to initialize the padding bytes
>>
>> I did some experiements with gcc and my observations are:
>>
>> 1. it doesn't depend on whether the initializer is constant or variable,
>> but...
>
>
> My observation is based on LLVM. Could you also double check the LLVM case?

With clang-3.5 from Ubuntu and -O2 I'm seeing the same as you: with
only constants it zeroes the padding, with variables it doesn't.

>>
>> 2. whether or not padding gets initialized depends on *which fields*
>> you're initializing (I assume this has to do with what instructions it
>> ends up using, as it might be faster to do a 32-bit mov on x86 instead
>> of an 8-bit one if you're initializing an 8-bit field which is
>> followed by 24 bits of padding, for example).

Vegard