From: Kees Cook <keescook@chromium.org>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: "Alexander Potapenko" <glider@google.com>,
"Joe Perches" <joe@perches.com>,
"open list:ANDROID DRIVERS" <devel@driverdev.osuosl.org>,
"Jann Horn" <jannh@google.com>,
"Peter Zijlstra" <peterz@infradead.org>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
LKML <linux-kernel@vger.kernel.org>,
"Arve Hjønnevåg" <arve@android.com>,
"Ingo Molnar" <mingo@redhat.com>,
"Dmitriy Vyukov" <dvyukov@google.com>,
"Todd Kjos" <tkjos@google.com>
Subject: Re: [PATCH v2 2/3] binder: do not initialize locals passed to copy_from_user()
Date: Wed, 4 Mar 2020 10:13:40 -0800 [thread overview]
Message-ID: <202003040951.7857DFD936@keescook> (raw)
In-Reply-To: <20200303093832.GD24372@kadam>
On Tue, Mar 03, 2020 at 12:38:32PM +0300, Dan Carpenter wrote:
> The real fix is to initialize everything manually, the automated
> initialization is a hardenning feature which many people will disable.
I cannot disagree more with this sentiment. Linus has specifically said he
wants this initialization on by default[1], and the major thing holding
that back from happening is that no one working on GCC has had time to
add this feature there. All the kernels I know of that are built with
Clang (Android, Chrome OS, OpenMandriva) either already have this turned
on or have plans to do so shortly.
> So I don't think the hardenning needs to be perfect, it needs to simple
> and fast.
I think it should be able to be intelligently optimized, so I'm all for
finding ways to mark function arguments as "will be initialized" in some
fashion.
-Kees
[1] "Oh, I love that patch." https://lore.kernel.org/lkml/CA+55aFykZL+cSBJjBBts7ebEFfyGPdMzTmLSxKnT_29=j942dA@mail.gmail.com/
--
Kees Cook
next prev parent reply other threads:[~2020-03-04 18:13 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-03-02 13:04 [PATCH v2 1/3] compiler.h: define __no_initialize glider
2020-03-02 13:04 ` [PATCH v2 2/3] binder: do not initialize locals passed to copy_from_user() glider
2020-03-02 13:09 ` Joe Perches
2020-03-02 13:25 ` Alexander Potapenko
2020-03-02 13:52 ` Dan Carpenter
2020-03-02 13:58 ` Joe Perches
2020-03-02 18:17 ` Alexander Potapenko
2020-03-02 18:31 ` Jann Horn
2020-03-05 9:03 ` Rasmus Villemoes
2020-03-05 12:45 ` Jann Horn
2020-03-06 2:29 ` Al Viro
2020-03-02 18:50 ` Joe Perches
2020-03-03 9:14 ` Alexander Potapenko
2020-03-03 9:38 ` Dan Carpenter
2020-03-03 13:56 ` Joe Perches
2020-03-03 14:15 ` Dan Carpenter
2020-03-04 18:13 ` Kees Cook [this message]
2020-03-05 8:07 ` Dan Carpenter
2020-03-05 8:26 ` Kees Cook
2020-03-05 8:33 ` Alexander Potapenko
2020-03-02 17:38 ` Greg KH
2020-03-02 18:28 ` Alexander Potapenko
2020-03-02 13:04 ` [PATCH v2 3/3] sched/wait: avoid double initialization in ___wait_event() glider
2020-03-02 16:56 ` Todd Kjos
2020-03-02 18:03 ` Alexander Potapenko
2020-03-02 18:39 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202003040951.7857DFD936@keescook \
--to=keescook@chromium.org \
--cc=arve@android.com \
--cc=dan.carpenter@oracle.com \
--cc=devel@driverdev.osuosl.org \
--cc=dvyukov@google.com \
--cc=glider@google.com \
--cc=gregkh@linuxfoundation.org \
--cc=jannh@google.com \
--cc=joe@perches.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=tkjos@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.