linux-kernel - Re: [PATCH v1] compiler: prevent dead store elimination

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100228095520.GA29531@one.firstfloor.org>
Date:	Sun, 28 Feb 2010 10:55:20 +0100
From:	Andi Kleen <andi@...stfloor.org>
To:	Roel Kluin <roel.kluin@...il.com>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Mikael Pettersson <mikpe@...uu.se>, penberg@...helsinki.fi,
	Brian Gerst <brgerst@...il.com>, andi@...stfloor.org,
	Andrew Morton <akpm@...ux-foundation.org>,
	LKML <linux-kernel@...r.kernel.org>,
	linux-crypto@...r.kernel.org, Herbert@...dor.apana.org.au
Subject: Re: [PATCH v1] compiler: prevent dead store elimination

> Every byte in the [p,p+n[ range must be used. If you only use the
> first byte, via e.g. asm("" :: "m"(*(char*)p)), then the compiler
> _will_ skip scrubbing bytes beyond the first. This works with
> gcc-3.2.3 up to gcc-4.4.3.

You forgot to credit Mikael who did all the hard work figuring
this out?

>  /*
> + * Dead store elimination (DSE) is an optimization that may remove a write to
> + * a buffer that is not used anymore. Use ARRAY_PREVENT_DSE after a write when
> + * the scrub is required for security reasons.
> + */
> +#define ARRAY_PREVENT_DSE(p, n)				\

Maybe it's just me, but the name is ugly.

> +	do {						\
> +		struct __scrub { char c[n]; };		\


Better typeof(*p)[n]

> +++ b/include/linux/compiler-intel.h
> @@ -14,9 +14,11 @@
>   * It uses intrinsics to do the equivalent things.
>   */
>  #undef barrier
> +#undef ARRAY_PREVENT_DSE
>  #undef RELOC_HIDE
>  
>  #define barrier() __memory_barrier()
> +#define ARRAY_PREVENT_DSE(p, n)

Who says the Intel compiler doesn't need this?

I'm sure it does dead store elimination too and it understands
gcc asm syntax.

> +/**
> + * secure_bzero - Call memset to fill a region of memory with zeroes and
> + * ensure this memset is not removed due to dead store elimination.
> + * @p: Pointer to the start of the area.
> + * @n: The size of the area.
> + */
> +void secure_bzero(void *p, size_t n)
> +{
> +	memset(p, 0, n);
> +	ARRAY_PREVENT_DSE(p, n);

I think that's a candidate for a inline

-Andi

-- 
ak@...ux.intel.com -- Speaking for myself only.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/