Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 16 Jan 2017 20:30:29 +0100
From: "PaX Team" <>
To: Mark Rutland <>
CC:, Kees Cook <>,
        Emese Revfy <>,
        "AKASHI, Takahiro" <>,
        park jinbum <>,
        Daniel Micay <>,,
Subject: Re: [PATCH] gcc-plugins: Add structleak for more stack initialization

On 16 Jan 2017 at 15:24, Mark Rutland wrote:

> To me, it seems that the __user annotation can only be an indicator of
> an issue by chance. We have structures with __user pointers in structs
> that will never be copied to userspace, and conversely we have structs
> that don't contain a __user field, but will be copied to userspace.
> Maybe it happens that structs in more complex systems are more likely to
> contain some __user pointer. Was that part of the rationale?

it's as i explained in an earlier email: we wanted to pattern match a
specific bug situation and this was the easiest way (as you can see,
the plugin's code is very simple, not much effort went into it).

> I wonder if there's any analysis we can do of data passing into
> copy_to_user() and friends. I guess we can't follow the data flow across
> compilation units, but we might be able to follow it well enough if we
> added a new attribute that described whether data was to be copied to
> userspace.

there're are all kinds of data flow analyses you can do within and even
across translation units (summary info a'la size overflow hash tables or
LTO). i never went into that direction because i think the security goal
can be achieved without the performance impact of forced initialization.

Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.