linux-kernel - Re: [PATCH 0/2] tracing: Detect unsafe dereferencing of pointers from trace events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wiWF=ah_q1HBVUth2vuBx2TieN8U331y5FhXiehX-+=TQ@mail.gmail.com>
Date:   Fri, 26 Feb 2021 14:21:00 -0800
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Ingo Molnar <mingo@...nel.org>,
        Andrew Morton <akpm@...ux-foundation.org>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Jacob Wen <jian.w.wen@...cle.com>
Subject: Re: [PATCH 0/2] tracing: Detect unsafe dereferencing of pointers from
 trace events

On Fri, Feb 26, 2021 at 11:07 AM Steven Rostedt <rostedt@...dmis.org> wrote:
>
> The first patch scans the print fmts of the trace events looking for
> dereferencing pointers from %p*, and making sure that they refer back
> to the trace event itself.
>
> The second patch handles strings "%s" [..]

Doing this at runtime really feels like the wrong thing to do.

It won't even protect us from what happened - people like me and
Andrew won't even run those tracepoints in the first place, so we
won't notice.

It really would be much better in every respect to have this done by
checkpatch, I think.

            Linus