From: Kees Cook <keescook@chromium.org>
To: Joe Perches <joe@perches.com>
Cc: LKML <linux-kernel@vger.kernel.org>,
Julia Lawall <julia.lawall@lip6.fr>,
Dan Carpenter <error27@gmail.com>,
Oleg Drokin <oleg.drokin@intel.com>,
Andreas Dilger <andreas.dilger@intel.com>,
James Simmons <jsimmons@infradead.org>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
"John L. Hammond" <john.hammond@intel.com>,
Emoly Liu <emoly.liu@intel.com>,
Vitaly Fertman <vitaly_fertman@xyratex.com>,
Bruno Faccini <bruno.faccini@intel.com>,
Bruce Korb <bruce.korb@gmail.com>,
devel@driverdev.osuosl.org
Subject: Re: Designated initializers, struct randomization and addressing?
Date: Tue, 3 Jan 2017 15:47:24 -0800 [thread overview]
Message-ID: <CAGXu5jJUHZi5LUxFjG9XfKgipBpGYfdfUXM8q_xEWqQrqtq1Tw@mail.gmail.com> (raw)
In-Reply-To: <1482254995.1984.20.camel@perches.com>
On Tue, Dec 20, 2016 at 9:29 AM, Joe Perches <joe@perches.com> wrote:
> On Fri, 2016-12-16 at 17:00 -0800, Kees Cook wrote:
>> Prepare to mark sensitive kernel structures for randomization by making
> sure they're using designated initializers.
>
> About the designated initializer patches,
> which by themselves are fine of course,
> and the fundamental randomization plugin,
> c guarantees that struct member ordering
> is as specified.
>
> how is the code to be verified so that
> any use of things like offsetof and any
> address/indexing is not impacted?
AIUI, offsetof() works correctly in the face of this plugin, since the
ordering happens before the pass that handles offsetof(). Anything
that _does not_ use offsetof(), however, needs fixing. Based on the
work done in grsecurity, I don't see any added offsetof() uses that
are specific to the randomization plugin.
(Note that the randomization plugin is only on function pointer
structures, where using an offsetof() should be rare to none, and on
hand-selected structures, where missing offsetof() should be easy to
audit.)
-Kees
--
Kees Cook
Nexus Security
next prev parent reply other threads:[~2017-01-03 23:47 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-17 1:00 [PATCH] staging: lustre: ldlm: use designated initializers Kees Cook
2016-12-19 16:22 ` James Simmons
2016-12-19 16:47 ` Bruce Korb
2016-12-19 17:12 ` James Simmons
2016-12-20 7:10 ` Dan Carpenter
2016-12-20 14:57 ` Hammond, John
2016-12-20 16:47 ` Bruce Korb
2016-12-20 18:52 ` Dan Carpenter
2016-12-20 19:07 ` Dan Carpenter
2016-12-20 19:46 ` Kees Cook
[not found] ` <CY4PR11MB175166F4D71AC6994081356BCB910@CY4PR11MB1751.namprd11.prod.outlook.com>
2016-12-19 17:11 ` [lustre-devel] " James Simmons
2016-12-20 10:40 ` Dan Carpenter
2016-12-20 17:29 ` Designated initializers, struct randomization and addressing? Joe Perches
2017-01-03 23:47 ` Kees Cook [this message]
2017-01-03 23:55 ` Bruce Korb
2017-01-04 0:13 ` Kees Cook
2017-01-04 6:27 ` Julia Lawall
2017-01-04 6:35 ` Kees Cook
2017-01-04 16:55 ` Stephen Hemminger
2017-01-04 17:37 ` Julia Lawall
2017-01-04 22:30 ` Kees Cook
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAGXu5jJUHZi5LUxFjG9XfKgipBpGYfdfUXM8q_xEWqQrqtq1Tw@mail.gmail.com \
--to=keescook@chromium.org \
--cc=andreas.dilger@intel.com \
--cc=bruce.korb@gmail.com \
--cc=bruno.faccini@intel.com \
--cc=devel@driverdev.osuosl.org \
--cc=emoly.liu@intel.com \
--cc=error27@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=joe@perches.com \
--cc=john.hammond@intel.com \
--cc=jsimmons@infradead.org \
--cc=julia.lawall@lip6.fr \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg.drokin@intel.com \
--cc=vitaly_fertman@xyratex.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).