linux-kernel - Re: [GIT PULL] hardening updates for v6.5-rc1

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202306280920.CB69D0F75@keescook>
Date:   Wed, 28 Jun 2023 09:29:42 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Christoph Hellwig <hch@...radead.org>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Alexander Lobakin <aleksander.lobakin@...el.com>,
        Alexander Potapenko <glider@...gle.com>,
        Alex Deucher <alexander.deucher@....com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>,
        Arnd Bergmann <arnd@...db.de>,
        Arne Welzel <arne.welzel@...elight.com>,
        Azeem Shaikh <azeemshaikh38@...il.com>,
        Bill Wendling <morbo@...gle.com>,
        Conor Dooley <conor.dooley@...rochip.com>,
        "Darrick J. Wong" <djwong@...nel.org>,
        Dave Hansen <dave.hansen@...ux.intel.com>,
        Fangrui Song <maskray@...gle.com>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        Hans de Goede <hdegoede@...hat.com>,
        Jakub Kicinski <kuba@...nel.org>, Jan Kara <jack@...e.cz>,
        Joe Perches <joe@...ches.com>,
        John Paul Adrian Glaubitz <glaubitz@...sik.fu-berlin.de>,
        John Stultz <jstultz@...gle.com>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Marco Elver <elver@...gle.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Masami Hiramatsu <mhiramat@...nel.org>,
        Miguel Ojeda <ojeda@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Palmer Dabbelt <palmer@...osinc.com>,
        Simon Horman <simon.horman@...igine.com>,
        Song Liu <song@...nel.org>,
        Thorsten Leemhuis <linux@...mhuis.info>,
        Tyrel Datwyler <tyreld@...ux.ibm.com>,
        Wyes Karny <wyes.karny@....com>, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [GIT PULL] hardening updates for v6.5-rc1

On Tue, Jun 27, 2023 at 11:20:05PM -0700, Christoph Hellwig wrote:
> On Tue, Jun 27, 2023 at 05:34:57PM -0700, Kees Cook wrote:
> > - The under-development compiler attribute __counted_by has been added
> >   so that we can start annotating flexible array members with their
> >   associated structure member that tracks the count of flexible array
> >   elements at run-time. It is possible (likely?) that the exact syntax
> >   of the attribute will change before it is finalized, but GCC and Clang
> >   are working together to sort it out. Any changes can be made to the
> >   macro while we continue to add annotations. As an example, I have a
> >   treewide commit waiting with such annotations found via Coccinelle:
> >   https://git.kernel.org/linus/adc5b3cb48a049563dc673f348eab7b6beba8a9b
> >   See commit dd06e72e68bcb4070ef211be100d2896e236c8fb for more details.
> 
> So I've been following the discussion of that feature for clang and
> I can't wait to actually be able to use it.

Me too! :)

> But this feels a bit premature to me, not only due to the ongoing
> discussions on the syntax, but more importantly because I fear it

I was on the fence about this too, and in the end, I decided that any
syntax changes are going to be mostly mechanical, and in the meantime
we needed a way to capture the associations. This has been a pain point
for years as we've been doing flexible array conversions, since when
doing the work it usually becomes clear which struct member is tracking
the element count, but that information couldn't be reliably recorded
anywhere. Now we can include the annotation (which is the really important
part). If/when the exact syntax changes, we can either adjust the macro,
or at worst we can easily do a tree-wide change. But I really want to
start capturing the associations _now_, and get us all into the habit
of doing it, and I want it to be through some kind of regular syntax
(now that there are patches to both GCC and Clang that can validate the
results), not just comments.

> will be completely misued before we have a compiler actually supporting
> available widely enough that we have it in the usual test bots.

How do you see it being misused? Your mention of the test bots, I think,
means you're worried the annotations will go unchecked for valid syntax?
FWIW, I've got builders with the GCC and Clang patches that should catch
this.

-- 
Kees Cook