linux-kernel - Re: Rust kernel policy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <68D70981-9BEE-4286-8D91-330E91EEA79F@kernel.org>
Date: Sat, 01 Mar 2025 22:50:06 -0800
From: Kees Cook <kees@...nel.org>
To: Askar Safin <safinaskar@...omail.com>, uecker@...raz.at,
 dan.carpenter@...aro.org
CC: airlied@...il.com, boqun.feng@...il.com, gregkh@...uxfoundation.org,
 hch@...radead.org, hpa@...or.com, ksummit@...ts.linux.dev,
 linux-kernel@...r.kernel.org, miguel.ojeda.sandonis@...il.com,
 rust-for-linux@...r.kernel.org, torvalds@...ux-foundation.org
Subject: Re: Rust kernel policy



On March 1, 2025 5:22:29 AM PST, Askar Safin <safinaskar@...omail.com> wrote:
>Hi, Martin Uecker and Dan Carpenter.
>
>> No, this absolutely is useful.  This is what UBSan does now
>
>> BTW: Another option I am investigating it to have UBsan insert traps
>> into the code and then have the compiler emit a warning only when
>
>Clang sanitizers should not be enabled in production.
>See https://www.openwall.com/lists/oss-security/2016/02/17/9 for details

This is about ASan, in userspace, from almost a decade ago. Kernel UBSan and HW-KASan are used in production for a long time now. Take a look at Android and Chrome OS kernels since almost 5 years ago. Ubuntu and Fedora use the bounds sanitizer by default too. *Not* using the bounds sanitizer in production would be the mistake at this point. :)

-Kees

-- 
Kees Cook