lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Wed, 20 Feb 2019 18:35:46 +0100
From:   Arnd Bergmann <>
To:     Andrey Ryabinin <>
Cc:     Andrey Konovalov <>,
        Masahiro Yamada <>,
        Michal Marek <>,
        Andrew Morton <>,
        Dmitry Vyukov <>,
        Nick Desaulniers <>,
        Mark Brown <>, Qian Cai <>,
        Alexander Potapenko <>,
        Martin Schwidefsky <>,
        Christoph Lameter <>,
        LKML <>,
        Linux Kbuild mailing list <>,
        kasan-dev <>
Subject: Re: [PATCH] kasan: turn off asan-stack for clang-8 and earlier

On Wed, Feb 20, 2019 at 6:00 PM Andrey Ryabinin <> wrote:
> On 2/20/19 5:51 PM, Arnd Bergmann wrote:
> > On Wed, Feb 20, 2019 at 3:45 PM Andrey Konovalov <> wrote:
> > I would have to some more research, but I expect several hundred
> > patches before we get to a clean randconfig build with a broken
> > compiler.
> Manually maintaining asan-stack parameter for the sake of one broken compiler isn't a great idea either.
> Couple alternative suggestions:
> 1) If we can't fix the problem or the cost of fixing is too high, maybe just hide it? Disable -Wframe-larger-then on pre clang-9 compilers.
> 2) Fallback cflags. The idea is to try to compile every the file with "-mllvm -asan-stack=1 -Wframe-larger-than=2048 -Werror" at first,
>  and fallback to "-mllvm -asan-stack=0" if failed. So it would be something similar to $(call cc-option, -mllvm -asan-stack=1 -Wframe-larger-than=2048 -Werror, -mllvm -asan-stack=0)
>  except that "cc-option" tries options only once on some code example while  we need to try options on every file that we actually compile.
>  Honestly, I'm not sure that it's worthy to hack Kbuild engine for that particular use-case.

My original plan was to put this under CONFIG_KASAN_EXTRA to allow you
to still enable it in older compilers, but you just removed that option ;-)

Maybe bringing it back would be a compromise? That way it's hidden from
all the build testing bots (because of the !CONFIG_COMPILE_TEST dependency),
but anyone who really wants it can still have the option, and set
to whichever value they like.


Powered by blists - more mailing lists