linux-kernel - Re: Rust kernel policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHk-=wjQ94GipftbNo0PbfuUxFMXFyp2bWGJJPNUngyf17Ai8A@mail.gmail.com>
Date: Fri, 21 Feb 2025 15:04:04 -0800
From: Linus Torvalds <torvalds@...ux-foundation.org>
To: Steven Rostedt <rostedt@...dmis.org>
Cc: Martin Uecker <uecker@...raz.at>, Dan Carpenter <dan.carpenter@...aro.org>, 
	Greg KH <gregkh@...uxfoundation.org>, Boqun Feng <boqun.feng@...il.com>, 
	"H. Peter Anvin" <hpa@...or.com>, Miguel Ojeda <miguel.ojeda.sandonis@...il.com>, 
	Christoph Hellwig <hch@...radead.org>, rust-for-linux <rust-for-linux@...r.kernel.org>, 
	David Airlie <airlied@...il.com>, linux-kernel@...r.kernel.org, ksummit@...ts.linux.dev
Subject: Re: Rust kernel policy

On Fri, 21 Feb 2025 at 14:23, Steven Rostedt <rostedt@...dmis.org> wrote:
>
> If I could just get a warning for this stupid mistake:
>
>         size_t ret;
>
>         ret = func();
>         if (ret < 0)
>                 error();

Note that my main beef with the crazy compiler warning is that it
literally triggers for *RANGE CHECKS*.

IOW, it's literally the "if (a < 0 || a > XYZ)" thing that absolutely
MUST NOT WARN. EVER.  If it does, the compiler is broken.

And gcc still warns of it with -Wtype-limits. So we turn that garbage off.

It's worth noting that "-Wtype-limits" is simply a broken concept for
other reasons too. It's not just the "unsigned type cannot be
negative" thing. It has the exact same problems on the other end.

Imagine that you have macros that do sanity testing of their
arguments, including things like checking for overflow conditions or
just checking for invalid values. What a concept - safe programming
practices with proper error handling.

Now imagine that you pass that an argument that comes from - for
example - a "unsigned char". It's the same exact deal. Now the
compiler warns about YOUR CODE BEING CAREFUL.

See why I hate that warning so much? It's fundamentally garbage, and
it's not even about your error condition at all.

Now, what *might* actually be ok is a smarter warning that warns about
actual real and problematic patterns, like your particular example.

Not some garbage crazy stuff that warns about every single type limit
check the compiler sees, but about the fact that you just cast a
signed value to an unsigned type, and then checked for signedness, and
you did *not* do a range check.

Warning for *that* might be a sane compiler warning.

But notice how it's fundamentally different from the current
sh*t-for-brains warning that we explicitly disable because it's broken
garbage.

So don't confuse a broken warning that might trigger for your code
with a good warning that would also trigger for your code.

            Linus