linux-kernel - Re: [PATCH] kasan: support use-after-scope detection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACT4Y+ZBhPhV+DjGKuFUprq87aexz2RpCH_Fn2NYkYzsCzWF8w@mail.gmail.com>
Date:   Wed, 16 Nov 2016 08:23:46 +0100
From:   Dmitry Vyukov <dvyukov@...gle.com>
To:     Andrew Morton <akpm@...ux-foundation.org>
Cc:     Andrey Ryabinin <aryabinin@...tuozzo.com>,
        Alexander Potapenko <glider@...gle.com>,
        kasan-dev <kasan-dev@...glegroups.com>,
        "linux-mm@...ck.org" <linux-mm@...ck.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] kasan: support use-after-scope detection

On Wed, Nov 16, 2016 at 12:40 AM, Andrew Morton
<akpm@...ux-foundation.org> wrote:
> On Tue, 15 Nov 2016 17:07:25 +0100 Dmitry Vyukov <dvyukov@...gle.com> wrote:
>
>> Gcc revision 241896 implements use-after-scope detection.
>> Will be available in gcc 7. Support it in KASAN.
>>
>> Gcc emits 2 new callbacks to poison/unpoison large stack
>> objects when they go in/out of scope.
>> Implement the callbacks and add a test.
>>
>> ...
>>
>> --- a/lib/test_kasan.c
>> +++ b/lib/test_kasan.c
>> @@ -411,6 +411,29 @@ static noinline void __init copy_user_test(void)
>>       kfree(kmem);
>>  }
>>
>> +static noinline void __init use_after_scope_test(void)
>
> This reader has no idea why this code uses noinline, and I expect
> others will have the same issue.
>
> Can we please get a code comment in there to reveal the reason?

Mailed v2 with a comment re noinline.

Taking the opportunity also fixed a type in the new comment:

- /* Emitted by compiler to unpoison large objects when they go into
of scope. */
+ /* Emitted by compiler to unpoison large objects when they go into scope. */