linux-kernel - Re: [PATCH 2/2] mm/usercopy: enable usercopy size checking for modern versions of gcc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 26 Aug 2016 15:56:27 -0500
From:   Josh Poimboeuf <jpoimboe@...hat.com>
To:     Kees Cook <keescook@...omium.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...nel.org>,
        "H . Peter Anvin" <hpa@...or.com>,
        "x86@...nel.org" <x86@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...capital.net>,
        Steven Rostedt <rostedt@...dmis.org>,
        Brian Gerst <brgerst@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Frederic Weisbecker <fweisbec@...il.com>,
        Byungchul Park <byungchul.park@....com>,
        Nilay Vaish <nilayvaish@...il.com>
Subject: Re: [PATCH 2/2] mm/usercopy: enable usercopy size checking for
 modern versions of gcc

On Fri, Aug 26, 2016 at 08:55:33AM -0500, Josh Poimboeuf wrote:
> On Fri, Aug 26, 2016 at 09:42:42AM -0400, Kees Cook wrote:
> > On Thu, Aug 25, 2016 at 11:27 PM, Josh Poimboeuf <jpoimboe@...hat.com> wrote:
> > > On Thu, Aug 25, 2016 at 10:14:36PM -0400, Kees Cook wrote:
> > >> Okay, right. __builtin_object_size() is totally fine, I absolutely
> > >> misspoke: it's the resolution of const value ranges. I wouldn't expect
> > >> gcc to warn here, though, since "copy + 1" isn't a const value...
> > >
> > > Look at the code again :-)
> > >
> > > __copy_to_user_overflow(), which does the "provably correct" warning, is
> > > "called" when the copy size is non-const (and the object size is const).
> > > So "copy + 1" being non-const is consistent with the warning.
> > 
> > Right, yes. Man, this is hard to read. All the names are the same. ;)
> 
> Yeah, agreed.  The code is way too cryptic.
> 
> > So this will trigger when the object size is known but the copy length
> > is non-const?
> 
> Right.
> 
> > When I played with re-enabling this in the past, I didn't hit very
> > many false positives. I sent a bunch of patches a few months back for
> > legitimate problems that this warning pointed out, so I'm a bit
> > cautious to just entirely drop it.
> 
> Ah, I didn't realize that.  We should definitely keep
> DEBUG_STRICT_USER_COPY_CHECKS then.  Though it would be *really* nice to
> find a way to associate some kind of whitelist with it to separate the
> wheat from all the chaff.

Ok, so I could drop patch 1/2 and then resubmit 2/2 with an updated
patch header.

There's one problem with that though.  It's going to annoy a lot of
people who do allyesconfig/allmodconfig builds because
DEBUG_STRICT_USER_COPY_CHECKS adds several fake warnings.

Anybody know if there's a way to disable an option for
allyesconfig/allmodconfig?

-- 
Josh