linux-kernel - Re: [PATCH] s390: disable -Warray-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 8 Jun 2022 18:22:18 -0700
From:   Linus Torvalds <torvalds@...ux-foundation.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Philipp Zabel <p.zabel@...gutronix.de>,
        Shawn Guo <shawnguo@...nel.org>,
        Sascha Hauer <s.hauer@...gutronix.de>,
        Fabio Estevam <festevam@...il.com>,
        David Howells <dhowells@...hat.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Heiko Carstens <hca@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] s390: disable -Warray-bounds

On Wed, Jun 8, 2022 at 5:39 PM Kees Cook <keescook@...omium.org> wrote:
>
> I'll take a look; thanks! Should I send them back as a pull request?

That would be good.

> Yeah. Happily, this has already been solved, but it looks like David didn't do a pull yet for it?
>
> https://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs.git/log/?h=fscache-next

Good.

> For gcc's UBSAN_SHIFT (I typoed this in my first reply) bug, netdev has been moving it to W=1 builds on a per-source basis for the moment:
>
> https://git.kernel.org/linus/e95032988053c17baf6c7e27024f5103a19a5f4a

Ugh. That's sad. Since now the gcc-12 misfeature ends up biting
everybody else too.

> Perhaps these could be even more carefully limited to GCC 12 only, using the Kconfig you suggested?

Yeah, I'd rather just say "gcc-12 gets this thing entirely wrong,
let's disable it there" than disable it for compilers that get it
right.

In fact, I'd rather have that global "gcc-12 is broken, disable it",
than marking "this file shouldn't get checked" kind of logic.

It's wrong blaming the C code, when the compiler is doing bad sh*t.

                Linus