linux-kernel - Re: [git patches 1/2] warnings: attack valid cases spotted by warnings

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <469D8932.9080101@garzik.org>
Date:	Tue, 17 Jul 2007 23:29:54 -0400
From:	Jeff Garzik <jeff@...zik.org>
To:	Roland Dreier <rdreier@...co.com>
CC:	Linus Torvalds <torvalds@...ux-foundation.org>,
	akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
	linux-ide@...r.kernel.org, chas@....nrl.navy.mil,
	rolandd@...co.com, dwmw2@...radead.org, gregkh@...e.de
Subject: Re: [git patches 1/2] warnings: attack valid cases spotted by warnings

Roland Dreier wrote:
> In this case the code is basically
> 
> 	u32 x;
> 
> 	for (n = 0; cond; ++n) {
> 		...
> 		if (!n)
> 			x = something;
> 		...
> 	}
> 
> 	if (n) {
> 		...
> 		use(x);
> 		...
> 	}
> 
> and gcc still warns...

Interestingly, the above accurately describes a common code pattern 
matching code which caused gcc to emit the uninit'd-var warnings.

For the record I think initializating 'f0' to zero is safer for the 
reasons Linus gave, and in addition, f0 is or'd with a value written to 
a hardware register, which means things should go awry (if they go) in a 
semi-predictable manner.

According to the assembly language produced, sure it is larger -- by one 
(per function) MOV that is adjacent to other initializations, making it 
highly likely the initializations are all streamed together.  I doubt 
one MOV per function will make a huge difference, considering the peace 
of mind it buys.

	Jeff

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/