Messages in this thread | | | From | "Jason A. Donenfeld" <> | Date | Tue, 27 Jun 2017 21:11:28 +0200 | Subject | Re: [PATCH] kref: Avoid null pointer dereference after WARN |
| |
On Tue, Jun 27, 2017 at 4:49 PM, Andi Kleen <ak@linux.intel.com> wrote: > Is there any data how many security holes this would have > caught? Please no hand waving. A lot of the recent > security patches seem to have gone in with just a lot of > hand waving and security theater
I don't practice security theater. What an offensive insinuation. Maybe you just meant this about other patches, however.
The point was that if there prior was a WARN_ON, this needs to be a BUG_ON, since if the WARN_ON was put there with any validity, continuing after it will always be "fatal and potentially exploitable". Thus, it'd be better to change that to simply "fatal but not potentially exploitable". Not security theater. Logic fix.
The bigger question, though, is the value of these checks in the first place. Has anybody written a coccinelle check to look into this statically? Has it historically been a useful thing for driver developers to have? Is it good defense in depth or is it overkill? At the very least, the original authors of kref thought a WARN_ON was warranted, which means probably a BUG_ON is a sensible fix, until somebody does the work of investigating these more careful questions.
Jason
| |