linux-kernel - Re: Rust kernel policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <y75v63zqmgd3n42bprrbs2ppg32vhk2isppi6wxn7lfsdwd5sn@jm74cuwhadbj>
Date: Sat, 22 Feb 2025 12:53:15 -0500
From: Kent Overstreet <kent.overstreet@...ux.dev>
To: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Steven Rostedt <rostedt@...dmis.org>, Martin Uecker <uecker@...raz.at>, 
	Dan Carpenter <dan.carpenter@...aro.org>, Greg KH <gregkh@...uxfoundation.org>, 
	Boqun Feng <boqun.feng@...il.com>, "H. Peter Anvin" <hpa@...or.com>, 
	Miguel Ojeda <miguel.ojeda.sandonis@...il.com>, Christoph Hellwig <hch@...radead.org>, 
	rust-for-linux <rust-for-linux@...r.kernel.org>, David Airlie <airlied@...il.com>, linux-kernel@...r.kernel.org, 
	ksummit@...ts.linux.dev
Subject: Re: Rust kernel policy

On Fri, Feb 21, 2025 at 03:04:04PM -0800, Linus Torvalds wrote:
> On Fri, 21 Feb 2025 at 14:23, Steven Rostedt <rostedt@...dmis.org> wrote:
> >
> > If I could just get a warning for this stupid mistake:
> >
> >         size_t ret;
> >
> >         ret = func();
> >         if (ret < 0)
> >                 error();
> 
> Note that my main beef with the crazy compiler warning is that it
> literally triggers for *RANGE CHECKS*.
> 
> IOW, it's literally the "if (a < 0 || a > XYZ)" thing that absolutely
> MUST NOT WARN. EVER.  If it does, the compiler is broken.
> 
> And gcc still warns of it with -Wtype-limits. So we turn that garbage off.
> 
> It's worth noting that "-Wtype-limits" is simply a broken concept for
> other reasons too. It's not just the "unsigned type cannot be
> negative" thing. It has the exact same problems on the other end.
> 
> Imagine that you have macros that do sanity testing of their
> arguments, including things like checking for overflow conditions or
> just checking for invalid values. What a concept - safe programming
> practices with proper error handling.
> 
> Now imagine that you pass that an argument that comes from - for
> example - a "unsigned char". It's the same exact deal. Now the
> compiler warns about YOUR CODE BEING CAREFUL.
> 
> See why I hate that warning so much? It's fundamentally garbage, and
> it's not even about your error condition at all.

Hang on, it sounds like you're calling that warning garbage purely
because it triggers on range checks macros?

Because it sounds like coming up with a different way to write range
checks is going to be easier than coming up with pattern matching magic.