From mboxrd@z Thu Jan 1 00:00:00 1970 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED, MAILING_LIST_MULTI,RCVD_IN_DNSWL_LOW,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.4 Received: (qmail 698 invoked from network); 26 May 2023 09:26:28 -0000 Received: from second.openwall.net (193.110.157.125) by inbox.vuxu.org with ESMTPUTF8; 26 May 2023 09:26:28 -0000 Received: (qmail 18022 invoked by uid 550); 26 May 2023 09:26:13 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 17972 invoked from network); 26 May 2023 09:26:12 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=inria.fr; s=dc; h=from:to:subject:date:message-id:in-reply-to:references: mime-version:content-transfer-encoding; bh=K8lbi/80AeJmSjAVRIZALdCtAB0beZJe5+88JsIFcc0=; b=m1MeAlEuHWwdFvlq5SneFseuzjvuEx4RgfGdf0beBG6xPDtvFEPkBmdI 5LPw0wW/xAZ+rnJrkezVYGZuaakDzgFlWWk0fSCIK8bNDygEx3IAW6OMf u/bM41f6N8NGiq53vZFN8lEufKeIag3G4L4+v3JnYKZ7OocweqTbvRgW2 8=; Authentication-Results: mail2-relais-roc.national.inria.fr; dkim=none (message not signed) header.i=none; spf=SoftFail smtp.mailfrom=Jens.Gustedt@inria.fr; dmarc=fail (p=none dis=none) d=inria.fr X-IronPort-AV: E=Sophos;i="6.00,193,1681164000"; d="scan'208";a="109847488" From: Jens Gustedt To: musl@lists.openwall.com Date: Fri, 26 May 2023 11:25:43 +0200 Message-Id: X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [musl] [C23 string conversion 1/3] C23: add the new memset_explicit function This function is meant to work around the fact that C compilers are allowed to optimize calls to memset out, if they are able to detect that the byte array will die soon, anyway. This permission for memset may lead to data leak when non-priveledged parts of an application would be able to reconstruct secret information from memory received through malloc or on the stack. This function here is to force compilers to do the clean up operation under all circumstances. How to do that is out of the scope of the C standard, so there is not much help there, it only describes the intent. By having a slow bytewise copy, we intent also to have predictable timing, such that we can avoid side-channel attacks. We also do our best to remove the meta-information, which is the pointer value from the stack and combine that with a synchronizing operation at the end. --- include/string.h | 1 + src/string/memset_explicit.c | 14 ++++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 src/string/memset_explicit.c diff --git a/include/string.h b/include/string.h index 05019c03..78ccccbd 100644 --- a/include/string.h +++ b/include/string.h @@ -27,6 +27,7 @@ extern "C" { void *memcpy (void *__restrict, const void *__restrict, size_t); void *memmove (void *, const void *, size_t); void *memset (void *, int, size_t); +void *memset_explicit(void *, int, size_t); int memcmp (const void *, const void *, size_t); void *(memchr) (const void *, int, size_t); diff --git a/src/string/memset_explicit.c b/src/string/memset_explicit.c new file mode 100644 index 00000000..49ced751 --- /dev/null +++ b/src/string/memset_explicit.c @@ -0,0 +1,14 @@ +#include +#include +#include + +void *memset_explicit(void *dest, register int c, register size_t n) +{ + register unsigned char volatile *p = dest; + register unsigned char volatile *stop = p + n; + for (; p < stop; ++p) + *p = c; + // the CAS operation serves as memory barrier, and destroys the + // information, if it happened to be spilled on the stack + return a_cas_p(&dest, dest, 0); +} -- 2.34.1