linux-kernel - Re: [git patches 1/2] warnings: attack valid cases spotted by warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <adaejj6o1aw.fsf@cisco.com>
Date:	Tue, 17 Jul 2007 20:09:27 -0700
From:	Roland Dreier <rdreier@...co.com>
To:	Linus Torvalds <torvalds@...ux-foundation.org>
Cc:	Jeff Garzik <jeff@...zik.org>, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org, linux-ide@...r.kernel.org,
	chas@....nrl.navy.mil, rolandd@...co.com, dwmw2@...radead.org,
	gregkh@...e.de
Subject: Re: [git patches 1/2] warnings: attack valid cases spotted by warnings

 > > So setting a variable to something meaningless (guaranteeing that a 
 > > garbage value is used in case of a bug) just to shut up a warning makes 
 > > no sense -- it's no safer than leaving the code as is.  
 > 
 > Wrong.
 > 
 > It's safer for two reasons:
 >  - now everybody will see the *same* behaviour
 >  - the "meaningless value" is guaranteed to not be a security leak
 > 
 > but the whole "shut up bogus warnings" is the best reason.
 > 
 > So it *is* safer than leaving the code as-is.

OK, fair enough.  What I said wasn't quite right, but in my case I
think neither of your reasons really applies, since the uninitialized
variable would be written into some hardware control block, so the
effect would probably still be random even if the value is the same
and the information leak doesn't really matter.

Anyway, I think that in this case it's not too hard to show that the
variable really can't be used uninitialized, so I prefer the smaller
generated code from uninitialized_var() (plus a comment explaining why
that's safe).

 > Of course, usually the best approach is to rewrite the code to be simpler, 
 > so that even gcc sees that something is obviously initialized. Sadly, 
 > people seldom do the right thing, and sometimes gcc just blows incredibly 
 > hard.

In this case the code is basically

	u32 x;

	for (n = 0; cond; ++n) {
		...
		if (!n)
			x = something;
		...
	}

	if (n) {
		...
		use(x);
		...
	}

and gcc still warns...

 - R.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/