lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Mon, 16 Jan 2017 14:01:18 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Michael Ellerman <mpe@...erman.id.au>
Cc:     Arnd Bergmann <arnd@...db.de>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] lkdtm: hide stack overflow warning for corrupt-stack test

On Mon, Jan 16, 2017 at 2:23 AM, Michael Ellerman <mpe@...erman.id.au> wrote:
> Arnd Bergmann <arnd@...db.de> writes:
>
>> After the latest change to make sure the compiler actually does a memset,
>> it is now smart enough to flag the stack overflow at compile time,
>> at least with gcc-7.0:
>>
>> drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':
>> drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
>>
>> To outsmart the compiler again, this moves the memset into a noinline
>> function where (for now) it doesn't see that we intentionally write
>> broken code here.
>
> Heh, darn it.
>
> I suspect this is an arms race we are eventually going to lose. At some
> point we might have to switch to writing some of these in asm :/

Yeah, though I'm going to keep trying to avoid this as much as
possible. I was almost there when building the .rodata execution test,
but I found horrible tricks. :P

-Kees

-- 
Kees Cook
Nexus Security

Powered by blists - more mailing lists