Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 8 Mar 2018 12:21:23 +0100 (CET)
From: Thomas Gleixner <tglx@...utronix.de>
To: Rasmus Villemoes <linux@...musvillemoes.dk>
cc: Kees Cook <keescook@...omium.org>, 
    Andrew Morton <akpm@...ux-foundation.org>, linux-kernel@...r.kernel.org, 
    corbet@....net, gustavo@...eddedor.com, rostedt@...dmis.org, 
    Chris Mason <clm@...com>, Josef Bacik <jbacik@...com>, 
    David Sterba <dsterba@...e.com>, "David S. Miller" <davem@...emloft.net>, 
    Alexey Kuznetsov <kuznet@....inr.ac.ru>, 
    Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>, 
    Ingo Molnar <mingo@...nel.org>, Peter Zijlstra <peterz@...radead.org>, 
    Masahiro Yamada <yamada.masahiro@...ionext.com>, 
    Borislav Petkov <bp@...e.de>, Josh Poimboeuf <jpoimboe@...hat.com>, 
    Randy Dunlap <rdunlap@...radead.org>, Ian Abbott <abbotti@....co.uk>, 
    "Tobin C. Harding" <me@...in.cc>, 
    Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>, 
    Petr Mladek <pmladek@...e.com>, 
    Andy Shevchenko <andriy.shevchenko@...ux.intel.com>, 
    Pantelis Antoniou <pantelis.antoniou@...sulko.com>, 
    linux-btrfs@...r.kernel.org, netdev@...r.kernel.org, 
    kernel-hardening@...ts.openwall.com
Subject: Re: [PATCH v2 1/3] vsprintf: Remove accidental VLA usage

On Thu, 8 Mar 2018, Rasmus Villemoes wrote:
> On 2018-03-08 04:30, Kees Cook wrote:
> >  /**
> > + * SIMPLE_MAX - return maximum of two values without any type checking
> > + * @x: first value
> > + * @y: second value
> > + *
> > + * This should only be used in stack array sizes, since the type-checking
> > + * from max() confuses the compiler into thinking a VLA is being used.
> > + */
> > +#define SIMPLE_MAX(x, y)	((size_t)(x) > (size_t)(y) ? (size_t)(x) \
> > +							   : (size_t)(y))
> 
> This will be abused at some point, leading to the usual double
> evaluation etc. etc. problems. The name is also too long (and in general
> we should avoid adjectives like "simple", "safe", people reading the
> code won't know what is simple or safe about it). I think this should work
> 
> #define MAX(x, y) (__builtin_choose_expr((x) > (y), x, y))
> 
> That forces (x)>(y) to be a compile-time constant, so x and y must also
> be; hence there can be no side effects. The MIN version of this could
> replace the custom __const_min in fs/file.c, and probably other places
> as well.
> 
> I tested that this at least works in the vsprintf case, -Wvla no longer
> complains. fs/file.c also compiles with the MIN version of this.
> 
> I suppose MIN and MAX will collide with other uses in the tree. Hmm.

Make it CONST_MAX() or something like that which makes it entirely clear.

Thanks,

	tglx

Powered by blists - more mailing lists

Your e-mail address:

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.