From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752637AbdBEXdj (ORCPT ); Sun, 5 Feb 2017 18:33:39 -0500 Received: from mail-it0-f47.google.com ([209.85.214.47]:37648 "EHLO mail-it0-f47.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751923AbdBEXdi (ORCPT ); Sun, 5 Feb 2017 18:33:38 -0500 MIME-Version: 1.0 In-Reply-To: <20170205154046.GF6515@twins.programming.kicks-ass.net> References: <1486164412-7338-1-git-send-email-keescook@chromium.org> <1486164412-7338-5-git-send-email-keescook@chromium.org> <20170205154046.GF6515@twins.programming.kicks-ass.net> From: Kees Cook Date: Sun, 5 Feb 2017 15:33:36 -0800 X-Google-Sender-Auth: oeUSM3qrErRctPIU9Xj533QK5Ow Message-ID: Subject: Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION To: Peter Zijlstra Cc: "Reshetova, Elena" , Greg KH , Arnd Bergmann , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Will Deacon , David Windsor , Hans Liljestrand , David Howells , LKML , "kernel-hardening@lists.openwall.com" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Feb 5, 2017 at 7:40 AM, Peter Zijlstra wrote: > On Fri, Feb 03, 2017 at 03:26:52PM -0800, Kees Cook wrote: >> This converts from WARN_ON() to CHECK_DATA_CORRUPTION() in the >> CONFIG_DEBUG_REFCOUNT case. Additionally moves refcount_t sanity check >> conditionals into regular function flow. Since CHECK_DATA_CORRUPTION() >> is marked __much_check, we override few cases where the failure has >> already been handled but we want to explicitly report it. >> >> Signed-off-by: Kees Cook >> --- >> include/linux/refcount.h | 35 ++++++++++++++++++++++------------- >> lib/Kconfig.debug | 2 ++ >> 2 files changed, 24 insertions(+), 13 deletions(-) >> >> diff --git a/include/linux/refcount.h b/include/linux/refcount.h >> index 5b89cad62237..ef32910c7dd8 100644 >> --- a/include/linux/refcount.h >> +++ b/include/linux/refcount.h >> @@ -43,10 +43,10 @@ >> #include >> >> #if CONFIG_DEBUG_REFCOUNT >> -#define REFCOUNT_WARN(cond, str) WARN_ON(cond) >> +#define REFCOUNT_CHECK(cond, str) CHECK_DATA_CORRUPTION(cond, str) > > OK, so that goes back to a full WARN() which will make the generated > code gigantic due to the whole printk() trainwreck :/ Hrm, perhaps we need three levels? WARN_ON, WARN, and BUG? -Kees -- Kees Cook Pixel Security From mboxrd@z Thu Jan 1 00:00:00 1970 MIME-Version: 1.0 Sender: keescook@google.com In-Reply-To: <20170205154046.GF6515@twins.programming.kicks-ass.net> References: <1486164412-7338-1-git-send-email-keescook@chromium.org> <1486164412-7338-5-git-send-email-keescook@chromium.org> <20170205154046.GF6515@twins.programming.kicks-ass.net> From: Kees Cook Date: Sun, 5 Feb 2017 15:33:36 -0800 Message-ID: Content-Type: text/plain; charset=UTF-8 Subject: [kernel-hardening] Re: [PATCH 4/4] refcount: Report failures through CHECK_DATA_CORRUPTION To: Peter Zijlstra Cc: "Reshetova, Elena" , Greg KH , Arnd Bergmann , Thomas Gleixner , Ingo Molnar , "H. Peter Anvin" , Will Deacon , David Windsor , Hans Liljestrand , David Howells , LKML , "kernel-hardening@lists.openwall.com" List-ID: On Sun, Feb 5, 2017 at 7:40 AM, Peter Zijlstra wrote: > On Fri, Feb 03, 2017 at 03:26:52PM -0800, Kees Cook wrote: >> This converts from WARN_ON() to CHECK_DATA_CORRUPTION() in the >> CONFIG_DEBUG_REFCOUNT case. Additionally moves refcount_t sanity check >> conditionals into regular function flow. Since CHECK_DATA_CORRUPTION() >> is marked __much_check, we override few cases where the failure has >> already been handled but we want to explicitly report it. >> >> Signed-off-by: Kees Cook >> --- >> include/linux/refcount.h | 35 ++++++++++++++++++++++------------- >> lib/Kconfig.debug | 2 ++ >> 2 files changed, 24 insertions(+), 13 deletions(-) >> >> diff --git a/include/linux/refcount.h b/include/linux/refcount.h >> index 5b89cad62237..ef32910c7dd8 100644 >> --- a/include/linux/refcount.h >> +++ b/include/linux/refcount.h >> @@ -43,10 +43,10 @@ >> #include >> >> #if CONFIG_DEBUG_REFCOUNT >> -#define REFCOUNT_WARN(cond, str) WARN_ON(cond) >> +#define REFCOUNT_CHECK(cond, str) CHECK_DATA_CORRUPTION(cond, str) > > OK, so that goes back to a full WARN() which will make the generated > code gigantic due to the whole printk() trainwreck :/ Hrm, perhaps we need three levels? WARN_ON, WARN, and BUG? -Kees -- Kees Cook Pixel Security