From: Nick Desaulniers <ndesaulniers@google.com>
To: "Jason A. Donenfeld" <Jason@zx2c4.com>,
Kees Cook <keescook@chromium.org>,
George Burgess <gbiv@google.com>
Cc: Nathan Chancellor <natechancellor@gmail.com>,
"open list:HARDWARE RANDOM NUMBER GENERATOR CORE"
<linux-crypto@vger.kernel.org>,
LKML <linux-kernel@vger.kernel.org>,
clang-built-linux <clang-built-linux@googlegroups.com>,
Arnd Bergmann <arnd@arndb.de>
Subject: Re: [PATCH] Kbuild: disable FORTIFY_SOURCE on clang-10
Date: Tue, 5 May 2020 16:36:49 -0700 [thread overview]
Message-ID: <CAKwvOdkrS-P_AS1azSCP-DVq_h8Dhb8YiLTfH=9zzEJQphZTcA@mail.gmail.com> (raw)
In-Reply-To: <CAHmME9q3zFe4e1xnpptJ27zywGqngZK2K7LCVzDSoG__ht=fNA@mail.gmail.com>
On Tue, May 5, 2020 at 4:22 PM Jason A. Donenfeld <Jason@zx2c4.com> wrote:
>
> On Tue, May 5, 2020 at 5:19 PM Kees Cook <keescook@chromium.org> wrote:
> >
> > (Though as was mentioned, it's likely that FORTIFY_SOURCE isn't working
> > _at all_ under Clang, so I may still send a patch to depend on !clang
> > just to avoid surprises until it's fixed, but I haven't had time to
> > chase down a solution yet.)
Not good. If it's completely broken, turn it off, and we'll prioritize fixing.
> That might be the most coherent thing to do, at least so that people
> don't get some false sense of mitigation.
Do we have a better test for "this is working as intended" or not
other than excessive stack usage, since that doesn't repro for
clang-9?
--
Thanks,
~Nick Desaulniers
next prev parent reply other threads:[~2020-05-05 23:37 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-05 13:59 [PATCH] crypto: curve25519-hacl64 - Disable fortify-source for clang-10 Arnd Bergmann
2020-05-05 21:39 ` Jason A. Donenfeld
2020-05-05 21:48 ` Nick Desaulniers
2020-05-05 21:49 ` Jason A. Donenfeld
2020-05-05 21:55 ` [PATCH] Kbuild: disable FORTIFY_SOURCE on clang-10 Jason A. Donenfeld
2020-05-05 22:02 ` Nick Desaulniers
2020-05-05 22:25 ` Nathan Chancellor
2020-05-05 22:37 ` George Burgess IV
2020-05-05 22:37 ` Jason A. Donenfeld
2020-05-05 23:19 ` Kees Cook
2020-05-05 23:22 ` Jason A. Donenfeld
2020-05-05 23:22 ` Jason A. Donenfeld
2020-05-05 23:36 ` Nick Desaulniers [this message]
2020-05-06 2:53 ` Kees Cook
2020-05-06 0:14 ` [PATCH v2] security: disable FORTIFY_SOURCE on clang Jason A. Donenfeld
2020-05-06 0:57 ` Nick Desaulniers
2020-05-06 2:54 ` Kees Cook
2020-05-06 3:34 ` Jason A. Donenfeld
2020-05-06 3:53 ` Nathan Chancellor
2020-05-06 16:48 ` George Burgess
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAKwvOdkrS-P_AS1azSCP-DVq_h8Dhb8YiLTfH=9zzEJQphZTcA@mail.gmail.com' \
--to=ndesaulniers@google.com \
--cc=Jason@zx2c4.com \
--cc=arnd@arndb.de \
--cc=clang-built-linux@googlegroups.com \
--cc=gbiv@google.com \
--cc=keescook@chromium.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=natechancellor@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.