linux-kernel - Re: [PATCH v7 01/25] kallsyms: avoid hardcoding the buffer size

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Yo8H6/CgjmvtC3Qz@iki.fi>
Date:   Thu, 26 May 2022 07:54:03 +0300
From:   Jarkko Sakkinen <jarkko@...nel.org>
To:     Miguel Ojeda <miguel.ojeda.sandonis@...il.com>
Cc:     Miguel Ojeda <ojeda@...nel.org>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        rust-for-linux <rust-for-linux@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Boqun Feng <boqun.feng@...il.com>,
        Kees Cook <keescook@...omium.org>
Subject: Re: [PATCH v7 01/25] kallsyms: avoid hardcoding the buffer size

On Tue, May 24, 2022 at 06:21:14PM +0200, Miguel Ojeda wrote:
> On Mon, May 23, 2022 at 9:46 PM Jarkko Sakkinen <jarkko@...nel.org> wrote:
> >
> > "Declare KSY_NAME_LEN, which describes the maximum length for a kernel
> > symbol read by kallsyms from the input.  In read_symbol(), define the
> > buffer to be of length "KSY_NAME_LEN + 1", which includes the terminator
> > character."
> >
> > would be better.
> 
> Note that the patch is not declaring `KSYM_NAME_LEN`, but a new
> constant for a fairly arbitrarily sized for an input buffer.
> 
> I am all for detailed commit messages, and I agree this can be
> expanded. However, I think the first sentence of what you wrote should
> be part of the docs of the constant, and the second one sounds like it
> could be a comment on the code. Something like "Introduce
> KSYM_NAME_LEN_BUFFER in place of the previously hardcoded size of the
> input buffer (...)" would be better for a reviewer.

Inline comment would be sufficient a remainder, and actually a better
idea.

> > You must split this then into two patches:
> 
> Note that the size is not really being increased in a meaningful way
> -- the important bit is the introduction of the relationship between
> constants. The changes are all meant as a replacement for the
> previously hardcoded constant, so I don't think the split is a "must",
> but we can do it.
> 
> We can even split this into 3 patches: clean up the unneeded `sizeof`,
> replace (and, importantly, document) the hardcoded constant, and
> finally introduce the relationship.
> 
> Thanks for taking a look!
> 
> Cheers,
> Miguel

BR, Jarkko