linux-kernel - Re: [PATCH v1 0/3] overlayfs: Optimize override/revert creds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 25 Apr 2024 10:47:32 -0700
From: Nathan Chancellor <nathan@...nel.org>
To: Vinicius Costa Gomes <vinicius.gomes@...el.com>
Cc: Christian Brauner <brauner@...nel.org>, amir73il@...il.com,
	hu1.chen@...el.com, miklos@...redi.hu, malini.bhandaru@...el.com,
	tim.c.chen@...el.com, mikko.ylinen@...el.com, lizhen.you@...el.com,
	linux-unionfs@...r.kernel.org, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, llvm@...ts.linux.dev
Subject: Re: [PATCH v1 0/3] overlayfs: Optimize override/revert creds

On Thu, Apr 25, 2024 at 10:12:34AM -0700, Vinicius Costa Gomes wrote:
> Christian Brauner <brauner@...nel.org> writes:
> 
> > On Wed, Apr 24, 2024 at 12:15:25PM -0700, Vinicius Costa Gomes wrote:
> >> I believe the crash and clang 17 compilation error point to the same
> >> problem, that in ovl_rename() some 'goto' skips the declaration of the
> >> (implicit) variable that the guard() macro generates. And it ends up
> >> doing a revert_creds_light() on garbage memory when ovl_rename()
> >> returns.
> >
> > If this is a compiler bug this warrants at least a comment in the commit
> > message because right now people will be wondering why that place
> > doesn't use a guard. Ideally we can just use guards everywhere though
> > and report this as a bug against clang, I think.
> >
> 
> I am seeing this like a bug/mising feature in gcc (at least in the
> version I was using), as clang (correctly) refuses to compile the buggy
> code (I agree with the error).

Indeed, your description of the issue and the fact clang refuses to
compile the problematic code makes me think that
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91951 is the relevant GCC
issue.

As an aside, just in case it comes up in the future, there is a
potential issue in clang's scope checking where it would attempt to
validate all labels in a function as potential destinations of 'asm
goto()' instances in that same function, rather than just the labels
that the 'asm goto()' could jump to, which can lead to false positive
errors about jumping past the initialization of a variable declared with
cleanup.

https://github.com/ClangBuiltLinux/linux/issues/1886
https://github.com/ClangBuiltLinux/linux/issues/2003

Cheers,
Nathan