linux-kernel - Re: [PATCH] Documentation patch (gcc-plugins kernel)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <9d1a86e8-0997-54ba-d3b9-58cc92af3a1f@linux.com>
Date:   Wed, 14 Aug 2019 14:29:07 +0300
From:   Alexander Popov <alex.popov@...ux.com>
To:     Kees Cook <keescook@...omium.org>,
        Robin Lindner <robin.lindner1@...nline.de>
Cc:     re.emese@...il.com, kernel-hardening@...ts.openwall.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Documentation patch (gcc-plugins kernel)

Hello Kees and Robin,

On 01.08.2019 23:14, Kees Cook wrote:
> On Thu, Aug 01, 2019 at 09:30:58AM +0200, Robin Lindner wrote:
>> Cleaned documentation comment up. I removed the "TODO" because it was very old.
>> ---
>>  scripts/gcc-plugins/stackleak_plugin.c | 2 --
>>  1 file changed, 2 deletions(-)
>>
>> diff --git a/scripts/gcc-plugins/stackleak_plugin.c b/scripts/gcc-plugins/stackleak_plugin.c
>> index dbd37460c573e..d8ba12c3bb238 100644
>> --- a/scripts/gcc-plugins/stackleak_plugin.c
>> +++ b/scripts/gcc-plugins/stackleak_plugin.c
>> @@ -144,8 +144,6 @@ static unsigned int stackleak_instrument_execute(void)
>>  	 *
>>  	 * Case in point: native_save_fl on amd64 when optimized for size
>>  	 * clobbers rdx if it were instrumented here.
>> -	 *
>> -	 * TODO: any more special cases?
>>  	 */
>>  	if (is_leaf &&
>>  	    !TREE_PUBLIC(current_function_decl) &&
> 
> As to the content of the patch, let's also CC Alexander...
> 
> Are there no more special cases?

I don't know other special cases when we should avoid the instrumentation.

And I can't imagine a method of finding such cases except runtime testing.

Robin, I would better save this comment only removing "TODO" if it matters.

Best regards,
Alexander