lkml.org 
[lkml]   [2010]   [Feb]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: Is kernel optimized with dead store removal?
Roel Kluin writes:
> According to http://cwe.mitre.org/data/slices/2000.html#14 due to optimization
> A call to memset() can be removed as a dead store when the buffer is not used
> after its value is overwritten. Does this optimization also occur during
> compilation of the Linux kernel? Then I think I may have found some
> vulnerabilities. One is sha1_update() where memset(temp, 0, sizeof(temp)); may
> be removed.

Any such dead store removal is up to the compiler and the lifetime
of the object being clobbered. For 'auto' objects the optimization
is certainly likely.

This is only a problem if the memory (a thread stack, say) is recycled
and leaked uninitialized to user-space, but such bugs are squashed
fairly quickly upon discovery.

(checking gcc-4.4.3)
It seems that memset((volatile void*)&some_local_var, 0, sizeof(...))
just provokes a warning about the invalid type of memset()'s first
parameter, but then still optimizes the operation away.

You might need to call an out-of-line helper function for this to work.


\
 
 \ /
  Last update: 2010-02-25 12:09    [W:0.074 / U:0.164 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site