linux-kernel - Re: [PATCH v3 2/2] module: Introduce module unload taint tracking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 22 Apr 2022 13:23:03 +0100
From:   Aaron Tomlin <atomlin@...hat.com>
To:     Christoph Lameter <cl@...two.de>
Cc:     Oleksandr Natalenko <oleksandr@...alenko.name>, mcgrof@...nel.org,
        pmladek@...e.com, mbenes@...e.cz, christophe.leroy@...roup.eu,
        akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
        linux-modules@...r.kernel.org, atomlin@...mlin.com,
        ghalat@...hat.com, neelx@...hat.com
Subject: Re: [PATCH v3 2/2] module: Introduce module unload taint tracking

On Fri 2022-04-22 10:11 +0200, Christoph Lameter wrote:
> On Thu, 21 Apr 2022, Aaron Tomlin wrote:
> 
> > > > +		if (len == strlen(mod->name) && !memcmp(mod_taint->name, mod->name, len) &&
> > >
> > > Here, two strings are compared, so I'd expect to see `strncmp()` instead of `memcmp()`.
> >
> > Good point. There are other examples of this throughout
> > kernel/module/main.c; albeit, I will use strncmp() here.
> 
> Comparing the length first may be an attempt to avoid the expensive
> memcmp. But here we need to first execute strlen() to obtain the string
> length. This is already accessing all characters so this
> check is wasteful and a straight str[n]cmp is better.

Hi Christoph,

Agreed - we can skip the extra strlen().

Thanks,

-- 
Aaron Tomlin