linux-kernel - Re: [PATCH] sha: prevent removal of memset as dead store in sha1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100225.071759.98314060.davem@davemloft.net>
Date:	Thu, 25 Feb 2010 07:17:59 -0800 (PST)
From:	David Miller <davem@...emloft.net>
To:	roel.kluin@...il.com
Cc:	herbert@...dor.apana.org.au, mikpe@...uu.se,
	linux-crypto@...r.kernel.org, akpm@...ux-foundation.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] sha: prevent removal of memset as dead store in
 sha1_update()

From: Roel Kluin <roel.kluin@...il.com>
Date: Thu, 25 Feb 2010 16:10:27 +0100

> Due to optimization A call to memset() may be removed as a dead store when
> the buffer is not used after its value is overwritten.
> 
> Signed-off-by: Roel Kluin <roel.kluin@...il.com>

Solution is wrong and overkill in my mind.

It's overkill because the whole reason it's using a stack buffer is to
avoid the overhead of a kmalloc() call.

And it's wrong because the reason the memset() is there seems to be
to clear out key information that might exist kernel stack so that
it's more difficult for rogue code to get at things.


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/