linux-kernel - Re: [PATCH v3 2/2] module: Introduce module unload taint tracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.DEB.2.22.394.2204221009390.1397495@gentwo.de>
Date:   Fri, 22 Apr 2022 10:11:38 +0200 (CEST)
From:   Christoph Lameter <cl@...two.de>
To:     Aaron Tomlin <atomlin@...hat.com>
cc:     Oleksandr Natalenko <oleksandr@...alenko.name>, mcgrof@...nel.org,
        pmladek@...e.com, mbenes@...e.cz, christophe.leroy@...roup.eu,
        akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
        linux-modules@...r.kernel.org, atomlin@...mlin.com,
        ghalat@...hat.com, neelx@...hat.com
Subject: Re: [PATCH v3 2/2] module: Introduce module unload taint tracking

On Thu, 21 Apr 2022, Aaron Tomlin wrote:

> > > +		if (len == strlen(mod->name) && !memcmp(mod_taint->name, mod->name, len) &&
> >
> > Here, two strings are compared, so I'd expect to see `strncmp()` instead of `memcmp()`.
>
> Good point. There are other examples of this throughout
> kernel/module/main.c; albeit, I will use strncmp() here.

Comparing the length first may be an attempt to avoid the expensive
memcmp. But here we need to first execute strlen() to obtain the string
length. This is already accessing all characters so this
check is wasteful and a straight str[n]cmp is better.