From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/6919 Path: news.gmane.org!not-for-mail From: =?UTF-8?Q?Daniel_Cegie=C5=82ka?= Newsgroups: gmane.linux.lib.musl.general Subject: Re: thoughts on reallocarray, explicit_bzero? Date: Wed, 28 Jan 2015 23:34:20 +0100 Message-ID: References: <20140519153130.GA519@muslin> <20140519161654.GO507@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable X-Trace: ger.gmane.org 1422484495 1807 80.91.229.3 (28 Jan 2015 22:34:55 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Wed, 28 Jan 2015 22:34:55 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-6932-gllmg-musl=m.gmane.org@lists.openwall.com Wed Jan 28 23:34:55 2015 Return-path: Envelope-to: gllmg-musl@m.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1YGbCH-00063d-Sn for gllmg-musl@m.gmane.org; Wed, 28 Jan 2015 23:34:53 +0100 Original-Received: (qmail 19889 invoked by uid 550); 28 Jan 2015 22:34:52 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 19881 invoked from network); 28 Jan 2015 22:34:52 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type:content-transfer-encoding; bh=UkQWE9wqsVBsxsMPq+Y+DWIbdWC+V3VMoT8OyEQcZA0=; b=OQAmFRUGbBE/4WtL/T8K4IK5IaDMtqBddy4wc0JwnvoTIk6Qww70RUsM8liN9ejnbc pnIJyd3sLhFC40eG51z0YXkp5LTZxoSy0fFiB696G2yJ3BSDrn/Stmdk8EUv+DDfoAfW u4BQok8hM35ZUCk6L7YvZnKkm1O26r87Vxvmiei5RoNBGSlvaHGDRHRTp3HCpHeC+hvD 3voVd3bz/S7QnCDtIFhlRxuXbe4SbNNaMxdbCvAmpmwYRhu9FO2ZzrHVClbWMmCfCxDq NNf+kKkjgO0hg973VBCWu03DVk8ZV/eItMkO0ykt5fC+DjfgXcM4E1BX+h7hzpqkIc+E UzHQ== X-Received: by 10.182.58.20 with SMTP id m20mr3759570obq.32.1422484480184; Wed, 28 Jan 2015 14:34:40 -0800 (PST) In-Reply-To: Xref: news.gmane.org gmane.linux.lib.musl.general:6919 Archived-At: 2015-01-28 23:01 GMT+01:00 Daniel Cegie=C5=82ka = : > 2014-05-19 18:16 GMT+02:00 Rich Felker : >> On Mon, May 19, 2014 at 05:44:59PM +0200, Daniel Cegie=C5=82ka wrote: > >>> diff -urN musl.orig/src/string/explicit_bzero.c musl/src/string/explici= t_bzero.c >>> --- musl.orig/src/string/explicit_bzero.c Thu Jan 1 00:00:00 1970 >>> +++ musl/src/string/explicit_bzero.c Fri May 9 09:57:45 2014 >>> @@ -0,0 +1,8 @@ >>> +#include >>> + >>> +static void *(*volatile explicit_memset)(void *, int, size_t) =3D mems= et; >>> + >>> +void explicit_bzero(void *b, size_t len) >>> +{ >>> + (*explicit_memset)(b, 0, len); >>> +} >> >> This is a nice trick, but IIRC I actually observed GCC optimizing out >> similar code before (instead of your static volatile, I used a >> volatile compound literal). At least the concept is right though: you >> want to prevent the compiler from being able to do any flow analysis >> at compile time, and making the function pointer volatile achieves >> this rather well. On the other hand, GCC will put the volatile pointer >> (if it even emits it) in non-constant memory, meaning it's an >> additional attack vector for function-pointer-overwrite attacks. > > Linux kernel has similar functions and uses a barrier() here: > > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/lib/= string.c?id=3Drefs/tags/v3.19-rc6#n600 > > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/incl= ude/linux/compiler.h?id=3Drefs/tags/v3.19-rc6#n162 > > Is such a solution is more correct (and still portable)? I'm afraid that the only appropriate solution is to use memset_s() from C11 and the expectation that the compiler will accept it. barrier() does not give any guarantee that this function will be secure. Only compiler decides. I'm afraid that OpenBSD goes bad path with explicit_bzero(). The same applies to the linux kernel and memzero_explicit().. very stupid name... Daniel