linux-kernel - RE: [+externe Mail+] RE: [PATCH] compiler.h: Explain how __is

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9c4518eae05c4758afe08c6b90678e92@AcuMS.aculab.com>
Date: Fri, 1 Mar 2024 13:43:23 +0000
From: David Laight <David.Laight@...LAB.COM>
To: "'Uecker, Martin'" <Martin.Uecker@....uni-goettingen.de>,
	"keescook@...omium.org" <keescook@...omium.org>, "linux@...musvillemoes.dk"
	<linux@...musvillemoes.dk>
CC: "corbet@....net" <corbet@....net>, "miguel.ojeda.sandonis@...il.com"
	<miguel.ojeda.sandonis@...il.com>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "linux-doc@...r.kernel.org"
	<linux-doc@...r.kernel.org>, "gustavoars@...nel.org" <gustavoars@...nel.org>,
	"ndesaulniers@...gle.com" <ndesaulniers@...gle.com>,
	"jani.nikula@...ux.intel.com" <jani.nikula@...ux.intel.com>,
	"ojeda@...nel.org" <ojeda@...nel.org>, "linux-hardening@...r.kernel.org"
	<linux-hardening@...r.kernel.org>
Subject: RE: [+externe Mail+] RE: [PATCH] compiler.h: Explain how
 __is_constexpr() works

From: Uecker, Martin
> Sent: 01 March 2024 13:22
> 
> My suggestion would also to limit explanation. Nobody should
> write such code and if you need to, you can find explanations
> all over the internet.
> 
> Finally, I still think the motivation for this macro (removing
> VLAs) is misguided if security is the goal because VLAs provide
> precise bounds and larger worst-case fixed-size arrays do not.
> 
> It would be better to use the compiler options that detect
> possibly use of VLAs of unbounded size and if there a problems
> with this, improve this on the compiler side.

In kernel code (with limited stack) there has to be enough room
for the largest possible 'VLA' so you might as well allocate one.

Allowing VLA also makes it pretty much impossible to do any
kind of static stack use analysis.
The fine IBT tags can be used identify valid indirect calls
which pretty much only leaves recursion stopping full static
stack analysis - and that could be banned except for a few
limited cases where 1 level could be permittd.

is_constexpr() has other uses - there are places where
__builtin_constant_p() isn't strong enough.
Particularly if you need to use builtin_choose_expr()
or _Generic() to get select a type.

For instance, if you can a constant value between 0 and MAXINT
it is safe to cast to/from unsigned in order change any
implicit integer promotion cast that may be grief some.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)