linux-kernel - Re: undefined behavior (-Wvarargs) in security/keys/trusted.c#TSS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 11 Oct 2018 18:02:56 +0200
From:   Arnd Bergmann <arnd@...db.de>
To:     Nick Desaulniers <ndesaulniers@...gle.com>
Cc:     "James E.J. Bottomley" <jejb@...ux.vnet.ibm.com>,
        zohar@...ux.vnet.ibm.com, dhowells@...hat.com, jmorris@...ei.org,
        serge@...lyn.com, linux-integrity@...r.kernel.org,
        keyrings@...r.kernel.org, linux-security-module@...r.kernel.org,
        LKML <linux-kernel@...r.kernel.org>,
        Nathan Chancellor <natechancellor@...il.com>,
        Eric Biggers <ebiggers@...gle.com>
Subject: Re: undefined behavior (-Wvarargs) in security/keys/trusted.c#TSS_authhmac()

On 10/10/18, Nick Desaulniers <ndesaulniers@...gle.com> wrote:
> Hello,
> I noticed that compiling with
> CONFIG_TCG_TPM=y
> CONFIG_HW_RANDOM_TPM=y
> and Clang produced the warning:
>
>   CC      security/keys/trusted.o
> security/keys/trusted.c:146:17: warning: passing an object that
> undergoes default
>       argument promotion to 'va_start' has undefined behavior [-Wvarargs]
>         va_start(argp, h3);
>                        ^
> security/keys/trusted.c:126:37: note: parameter of type 'unsigned
> char' is declared here
> unsigned char *h2, unsigned char h3, ...)
>                                ^
>
> Specifically, it seems that both the C90 (4.8.1.1) and C11 (7.16.1.4)
> standards explicitly call this out as undefined behavior:
>
> The parameter parmN is the identifier of the rightmost parameter in
> the variable parameter list in the function definition (the one just
> before the ...). If the parameter parmN is declared with ... or with a
> type that is not compatible with the type that results after
> application of the default argument promotions, the behavior is
> undefined.
>
> So if I understand my C promotion/conversion rules correctly, unsigned
> char would be promoted to int?
>
> We had a few ideas for possible fixes in:
> https://github.com/ClangBuiltLinux/linux/issues/41

I arrived at a similar patch as the one cited there, but it broke again
after an 'extern' declaration was added in include/keys/trusted.h,
so that has to be patched as well now.

       Arnd