12
Re: VLA removal (was Re: [RFC 2/2] lustre: use VLA_SAFE)
source link: https://lore.kernel.org/kernel-hardening/CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com/
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
Re: VLA removal (was Re: [RFC 2/2] lustre: use VLA_SAFE)
Kernel-hardening Archive on lore.kernel.org help / color / Atom feed
From: Linus Torvalds <[email protected]> To: Kees Cook <[email protected]>, Joern Engel <[email protected]> Cc: "Tobin C. Harding" <[email protected]>, "Tobin C. Harding" <[email protected]>, Kernel Hardening <[email protected]>, Tycho Andersen <[email protected]>, Oleg Drokin <[email protected]>, Andreas Dilger <[email protected]>, James Simmons <[email protected]>, Greg Kroah-Hartman <[email protected]>, LKML <[email protected]>, Herbert Xu <[email protected]>, Peter Zijlstra <[email protected]>, Ingo Molnar <[email protected]>, "Gustavo A. R. Silva" <[email protected]> Subject: Re: VLA removal (was Re: [RFC 2/2] lustre: use VLA_SAFE) Date: Wed, 7 Mar 2018 10:09:56 -0800 Message-ID: <CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com> (raw) In-Reply-To: <CAGXu5jJaVPPjqtpOLapk8ABT93zaUoaKR-i7Ga6LVSK2OiX_tQ@mail.gmail.com> On Wed, Mar 7, 2018 at 9:37 AM, Kees Cook <[email protected]> wrote: > > Building with -Wvla, I see 209 unique locations reported in 60 directories: > http://paste.ubuntu.com/p/srQxwPQS9s/ Ok, that's not so bad. Maybe Greg could even add it to one of those things he encourages new people to do? Because at least *some* of them are pretty trivial. For example, looking at the core code, I was surprised to see something in lib/btree.c And that is just garbage: it uses unsigned long key[geo->keylen]; which looks really dangerous, but that "struct btree_geo" is internal to that file, and there are exactly three instances of it, with 32, 64 and 128 bit keys respectively. Note that "keylen" isn't actually number of hits, but how many long-words you need. So in actual fact, that array is limited to that 128 bits - just 16 bytes. So keylen is at most 4 (on 32-bit architectures) or 2 (on 64-bit ones). Using #define MAXKEYLEN BITS_TO_LONGS(128) or something like that would be trivial. AND USING VLA'S IS ACTIVELY STUPID! It generates much more code, and much _slower_ code (and more fragile code), than just using a fixed key size would have done. Ok, so lib/btree.c looks more core (by being in lib/) than it actually is - I don't see the 128-bit btree being used *anywhere*, and the others are only used by two drivers: the qla2xxx scsi driver and the bcm2835-camera driver in staging. Anyway, some of these are definitely easy to just fix, and using VLA's is actively bad not just for security worries, but simply because VLA's are a really horribly bad idea in general in the kernel. Added Jörn Engel to the cc, since I looked at that lib/btree.c thing. But that is just three of the 209 instances. Some of the others might be slightly more painful to fix. Linus
next prev parent reply index Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-07 17:37 Kees Cook 2018-03-07 18:09 ` Linus Torvalds [this message] 2018-03-08 5:05 ` Daniel Micay 2018-03-13 21:10 ` [PATCH] btree: avoid variable-length allocations Jörn Engel
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to='CA+55aFzCG-zNmZwX4A2FQpadafLfEzK6CC=qPXydAacU1RqZWA@mail.gmail.com' \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ [email protected] \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
Kernel-hardening Archive on lore.kernel.org Archives are clonable: git clone --mirror https://lore.kernel.org/kernel-hardening/0 kernel-hardening/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 kernel-hardening kernel-hardening/ https://lore.kernel.org/kernel-hardening \ [email protected] public-inbox-index kernel-hardening Example config snippet for mirrors Newsgroup available over NNTP: nntp://nntp.lore.kernel.org/com.openwall.lists.kernel-hardening AGPL code for this site: git clone https://public-inbox.org/public-inbox.git
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK