From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S966744AbdACXrv (ORCPT <rfc822;w@1wt.eu>);
        Tue, 3 Jan 2017 18:47:51 -0500
Received: from mail-io0-f172.google.com ([209.85.223.172]:36812 "EHLO
        mail-io0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S966732AbdACXrk (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 3 Jan 2017 18:47:40 -0500
MIME-Version: 1.0
In-Reply-To: <1482254995.1984.20.camel@perches.com>
References: <20161217010045.GA140343@beast> <1482254995.1984.20.camel@perches.com>
From: Kees Cook <keescook@chromium.org>
Date: Tue, 3 Jan 2017 15:47:24 -0800
X-Google-Sender-Auth: 0SCeCxdvQEkQE6Eulh0WPMsegaw
Message-ID: <CAGXu5jJUHZi5LUxFjG9XfKgipBpGYfdfUXM8q_xEWqQrqtq1Tw@mail.gmail.com>
Subject: Re: Designated initializers, struct randomization and addressing?
To: Joe Perches <joe@perches.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
        Julia Lawall <julia.lawall@lip6.fr>, Dan Carpenter <error27@gmail.com>,
        Oleg Drokin <oleg.drokin@intel.com>,
        Andreas Dilger <andreas.dilger@intel.com>,
        James Simmons <jsimmons@infradead.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "John L. Hammond" <john.hammond@intel.com>,
        Emoly Liu <emoly.liu@intel.com>,
        Vitaly Fertman <vitaly_fertman@xyratex.com>,
        Bruno Faccini <bruno.faccini@intel.com>,
        Bruce Korb <bruce.korb@gmail.com>, devel@driverdev.osuosl.org
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, Dec 20, 2016 at 9:29 AM, Joe Perches <joe@perches.com> wrote:
> On Fri, 2016-12-16 at 17:00 -0800, Kees Cook wrote:
>> Prepare to mark sensitive kernel structures for randomization by making
> sure they're using designated initializers.
>
> About the designated initializer patches,
> which by themselves are fine of course,
> and the fundamental randomization plugin,
> c guarantees that struct member ordering
> is as specified.
>
> how is the code to be verified so that
> any use of things like offsetof and any
> address/indexing is not impacted?

AIUI, offsetof() works correctly in the face of this plugin, since the
ordering happens before the pass that handles offsetof(). Anything
that _does not_ use offsetof(), however, needs fixing. Based on the
work done in grsecurity, I don't see any added offsetof() uses that
are specific to the randomization plugin.

(Note that the randomization plugin is only on function pointer
structures, where using an offsetof() should be rare to none, and on
hand-selected structures, where missing offsetof() should be easy to
audit.)

-Kees

-- 
Kees Cook
Nexus Security