linux-kernel - Re: [PATCH 3/3] Enforce "unsigned long flags;" when spinlocking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20061020114640.9231b18f.akpm@osdl.org>
Date:	Fri, 20 Oct 2006 11:46:40 -0700
From:	Andrew Morton <akpm@...l.org>
To:	Alexey Dobriyan <adobriyan@...il.com>
Cc:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 3/3] Enforce "unsigned long flags;" when spinlocking

On Fri, 20 Oct 2006 17:15:44 +0400
Alexey Dobriyan <adobriyan@...il.com> wrote:

> Make it break or warn if you pass to spin_lock_irqsave() and friends
> something different from "unsigned long flags;". Suprisingly large amount of
> these was caught by recent commit c53421b18f205c5f97c604ae55c6a921f034b0f6 .
> 
> Idea is largely from FRV typechecking.
> 
> Note #1: checking with sparse is still needed, because a driver can save and
>          pass around flags or something. So far patch is very intrusive.
> Note #2: techically, we should break only if sizeof(flags) < sizeof(unsigned long),
>          but hey, there is opportunity to escalate. Thus !=
> Note #3: yes, would break every single buggy out-of-tree module.
> 

This is a pretty ugly-looking patch.

> 
> +		BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));	\
> +		typecheck(unsigned long, flags);			\
> ...
> +		BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));	\
> +		typecheck(unsigned long, flags);			\
> ...
> +		BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));	\
> +		typecheck(unsigned long, flags);			\
> ...
> +		BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));	\
> +		typecheck(unsigned long, flags);			\
> ...
> +		BUILD_BUG_ON(sizeof(flags) != sizeof(unsigned long));	\
> +		typecheck(unsigned long, flags);			\
> ...

starting to see a pattern here?

If we're going to do this then a helper macro build_check_irq_flags() would
help clean things up.  It will also allow us to centralise the
warning-vs-error policy decision.

I'm not sure that we need both, do we?  If it spits a warning then it'll
get fixed soon enough.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/