From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751177AbdAPTa4 (ORCPT ); Mon, 16 Jan 2017 14:30:56 -0500 Received: from r00tworld.com ([212.85.137.150]:36225 "EHLO r00tworld.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750777AbdAPTay (ORCPT ); Mon, 16 Jan 2017 14:30:54 -0500 From: "PaX Team" To: Mark Rutland Date: Mon, 16 Jan 2017 20:30:29 +0100 MIME-Version: 1.0 Subject: Re: [PATCH] gcc-plugins: Add structleak for more stack initialization Reply-to: pageexec@freemail.hu CC: kernel-hardening@lists.openwall.com, Kees Cook , Emese Revfy , "AKASHI, Takahiro" , park jinbum , Daniel Micay , linux-kernel@vger.kernel.org, spender@grsecurity.net Message-ID: <587D1F55.2222.8A262A4@pageexec.freemail.hu> In-reply-to: <20170116152425.GG5908@leverpostej> References: <20170113220256.GA57663@beast>, <5879F762.32059.37092152@pageexec.freemail.hu>, <20170116152425.GG5908@leverpostej> X-mailer: Pegasus Mail for Windows (4.72.572) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-2.1.12 (r00tworld.com [212.85.137.150]); Mon, 16 Jan 2017 20:30:28 +0100 (CET) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 16 Jan 2017 at 15:24, Mark Rutland wrote: > To me, it seems that the __user annotation can only be an indicator of > an issue by chance. We have structures with __user pointers in structs > that will never be copied to userspace, and conversely we have structs > that don't contain a __user field, but will be copied to userspace. > > Maybe it happens that structs in more complex systems are more likely to > contain some __user pointer. Was that part of the rationale? it's as i explained in an earlier email: we wanted to pattern match a specific bug situation and this was the easiest way (as you can see, the plugin's code is very simple, not much effort went into it). > I wonder if there's any analysis we can do of data passing into > copy_to_user() and friends. I guess we can't follow the data flow across > compilation units, but we might be able to follow it well enough if we > added a new attribute that described whether data was to be copied to > userspace. there're are all kinds of data flow analyses you can do within and even across translation units (summary info a'la size overflow hash tables or LTO). i never went into that direction because i think the security goal can be achieved without the performance impact of forced initialization.