linux-hardening - Re: [PATCH] lib/test_ubsan: Silence compile-time array bounds warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202112031506.D0FF887C1@keescook>
Date:   Fri, 3 Dec 2021 15:07:30 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Marco Elver <elver@...gle.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Arnd Bergmann <arnd@...db.de>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Andrey Konovalov <andreyknvl@...il.com>,
        Jiri Olsa <jolsa@...nel.org>, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH] lib/test_ubsan: Silence compile-time array bounds
 warnings

On Fri, Dec 03, 2021 at 05:53:15PM +0100, Marco Elver wrote:
> On Fri, 3 Dec 2021 at 17:21, Kees Cook <keescook@...omium.org> wrote:
> > On December 3, 2021 2:49:53 AM PST, Marco Elver <elver@...gle.com> wrote:
> [...]
> > >Are there other warnings or only the one for the fsanitize=object-size
> > >test? I think this is fine if there are other warnings.
> >
> > I will double check, but I think it's only the object-size test, which seems to confirm my suspicion that -Warray-bounds provides sufficient coverage and object-size can be removed.
> >
> > I have another patch I intend to send today for the sk_buff/sk_buff_head issue, as -Warray-bounds warns for that as well.
> 
> Nice.
> 
> Do you want to send the patch removing UBSAN_OBJECT_SIZE, or shall I
> do it? Perhaps it ties in better with the rest of your patches which I
> have no state of.

Sure; I'll tear it out. :) Thanks for doing the deep inspection on what
it is actually doing! That had been my main open question while digging
through all the -Warray-bounds warnings.

-- 
Kees Cook