linux-kernel - Re: [PATCH] devtmpfs: don't use vfs_getattr_nosec to query i

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250428131530.GA30382@lst.de>
Date: Mon, 28 Apr 2025 15:15:30 +0200
From: Christoph Hellwig <hch@....de>
To: Kees Cook <kees@...nel.org>
Cc: Christoph Hellwig <hch@....de>, Christian Brauner <brauner@...nel.org>,
	Heiko Carstens <hca@...ux.ibm.com>, gregkh@...uxfoundation.org,
	rafael@...nel.org, dakr@...nel.org, linux-kernel@...r.kernel.org,
	linux-fsdevel@...r.kernel.org,
	Shin'ichiro Kawasaki <shinichiro.kawasaki@....com>,
	Xiao Ni <xni@...hat.com>
Subject: Re: [PATCH] devtmpfs: don't use vfs_getattr_nosec to query i_mode

On Fri, Apr 25, 2025 at 08:40:23AM -0700, Kees Cook wrote:
> This isn't the case: the feature was explicitly designed in both GCC
> and Clang to not disrupt -Wuninitialized. But -Wuninitialized has been
> so flakey for so long that it is almost useless (there was even
> -Wmaybe-uninitialized added to try to cover some of the missed
> diagnostics).

I do remember a fair amount of bogus uninitialized variable warnings,
but they could be easily shut up without negative impact on the
code.  Not getting any warnings at all on the other hand is catastrophic.


> And it's one of the many reasons stack variable zeroing
> is so important, since so much goes undiagnosed. :(

That only helps if the expected but forgotten initialization value
actually is zero.