From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753265AbcHQAzP (ORCPT ); Tue, 16 Aug 2016 20:55:15 -0400 Received: from out2-smtp.messagingengine.com ([66.111.4.26]:37689 "EHLO out2-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752152AbcHQAzO (ORCPT ); Tue, 16 Aug 2016 20:55:14 -0400 X-Sasl-enc: SQI9G9shldyDCYSX5abpEK9MIXvvqH/IAHRyjYxh5KLl 1471395311 Date: Tue, 16 Aug 2016 21:55:09 -0300 From: Henrique de Moraes Holschuh To: Kees Cook Cc: "Paul E . McKenney" , Laura Abbott , Steven Rostedt , Stephen Boyd , Daniel Micay , Joe Perches , Arnd Bergmann , Greg Kroah-Hartman , Josh Triplett , Mathieu Desnoyers , Lai Jiangshan , "Aneesh Kumar K.V" , "Kirill A. Shutemov" , Michael Ellerman , Dan Williams , Andrew Morton , Ingo Molnar , Thomas Gleixner , Josef Bacik , Andrey Ryabinin , Tejun Heo , Nikolay Aleksandrov , Dmitry Vyukov , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: Re: [PATCH v2 0/5] bug: Provide toggle for BUG on data corruption Message-ID: <20160817005509.GA6281@khazad-dum.debian.net> References: <1471393229-27182-1-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1471393229-27182-1-git-send-email-keescook@chromium.org> X-GPG-Fingerprint1: 4096R/39CB4807 C467 A717 507B BAFE D3C1 6092 0BD9 E811 39CB 4807 User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, 16 Aug 2016, Kees Cook wrote: > This adds a CONFIG to trigger BUG()s when the kernel encounters > unexpected data structure integrity as currently detected with > CONFIG_DEBUG_LIST. > > Specifically list operations have been a target for widening flaws to gain > "write anywhere" primitives for attackers, so this also consolidates the > debug checking to avoid code and check duplication (e.g. RCU list debug > was missing a check that got added to regular list debug). It also stops > manipulations when corruption is detected, since worsening the corruption > makes no sense. (Really, everyone should build with CONFIG_DEBUG_LIST > since the checks are so inexpensive.) Well, maybe it wants a name that it looks like something that should be enabled by default on production kernels? I.e. CONFIG_DETECT_LIST_CORRUPTION or somesuch? -- Henrique Holschuh From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Tue, 16 Aug 2016 21:55:09 -0300 From: Henrique de Moraes Holschuh Message-ID: <20160817005509.GA6281@khazad-dum.debian.net> References: <1471393229-27182-1-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1471393229-27182-1-git-send-email-keescook@chromium.org> Subject: [kernel-hardening] Re: [PATCH v2 0/5] bug: Provide toggle for BUG on data corruption To: Kees Cook Cc: "Paul E . McKenney" , Laura Abbott , Steven Rostedt , Stephen Boyd , Daniel Micay , Joe Perches , Arnd Bergmann , Greg Kroah-Hartman , Josh Triplett , Mathieu Desnoyers , Lai Jiangshan , "Aneesh Kumar K.V" , "Kirill A. Shutemov" , Michael Ellerman , Dan Williams , Andrew Morton , Ingo Molnar , Thomas Gleixner , Josef Bacik , Andrey Ryabinin , Tejun Heo , Nikolay Aleksandrov , Dmitry Vyukov , linux-kernel@vger.kernel.org, kernel-hardening@lists.openwall.com List-ID: On Tue, 16 Aug 2016, Kees Cook wrote: > This adds a CONFIG to trigger BUG()s when the kernel encounters > unexpected data structure integrity as currently detected with > CONFIG_DEBUG_LIST. > > Specifically list operations have been a target for widening flaws to gain > "write anywhere" primitives for attackers, so this also consolidates the > debug checking to avoid code and check duplication (e.g. RCU list debug > was missing a check that got added to regular list debug). It also stops > manipulations when corruption is detected, since worsening the corruption > makes no sense. (Really, everyone should build with CONFIG_DEBUG_LIST > since the checks are so inexpensive.) Well, maybe it wants a name that it looks like something that should be enabled by default on production kernels? I.e. CONFIG_DETECT_LIST_CORRUPTION or somesuch? -- Henrique Holschuh