linux-hardening - Re: [PATCH 06/82] overflow: Reintroduce signed and unsigned overflow sanitizers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANiq72=K2Ux9obd6fP3sMhRxRpRs6_ow_5VbG0kjkw8vpx75_A@mail.gmail.com>
Date: Tue, 23 Jan 2024 12:20:17 +0100
From: Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
To: Kees Cook <kees@...nel.org>
Cc: Kees Cook <keescook@...omium.org>, linux-hardening@...r.kernel.org, 
	Justin Stitt <justinstitt@...gle.com>, Miguel Ojeda <ojeda@...nel.org>, 
	Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, 
	Peter Zijlstra <peterz@...radead.org>, Marco Elver <elver@...gle.com>, Hao Luo <haoluo@...gle.com>, 
	Przemek Kitszel <przemyslaw.kitszel@...el.com>, 
	"Gustavo A. R. Silva" <gustavoars@...nel.org>, Bill Wendling <morbo@...gle.com>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 06/82] overflow: Reintroduce signed and unsigned overflow sanitizers

On Tue, Jan 23, 2024 at 5:45 AM Kees Cook <kees@...nel.org> wrote:
>
> Yes. We removed this bad behavior by using -fno-strict-overflow, and we will want to keep it enabled.

Yeah, I only meant that the wording of the commit seems to say there
is something special about the "overflowing behavior", i.e. I was
expecting just UB with the usual implications, but given the extra
text in the parenthesis, I wondered while reading it if there was
something different/special going on.

> The stack usage is separate. (This may even be fixed in modern Clang; this comes from the original version of this Kconfig.) The not booting part is separate and has not been tracked down yet.

I see. Thanks! In any case, if the sentence means only 32-bit x86,
users couldn't still see it. But since this was already in the revert
now that I take a look, I guess ignore this :)

> I wondered the same -- they were this way when they were removed, so I just restored them as they were. :)

Makes sense :)

Cheers,
Miguel