On Tue, Jun 27, 2017 at 09:11:28PM +0200, Jason A. Donenfeld wrote: > On Tue, Jun 27, 2017 at 4:49 PM, Andi Kleen <a...@linux.intel.com> wrote: > > Is there any data how many security holes this would have > > caught? Please no hand waving. A lot of the recent > > security patches seem to have gone in with just a lot of > > hand waving and security theater > > I don't practice security theater. What an offensive insinuation. > Maybe you just meant this about other patches, however.
I'm not naming names, but there was a recent patch that seemed to have fixed one very extremely specific bug, but made every kernel exit forever slower. That was a classic case IMHO -- the Linux equivalent of shoes at airport checkpoints. > The point was that if there prior was a WARN_ON, this needs to be a > BUG_ON, since if the WARN_ON was put there with any validity, > continuing after it will always be "fatal and potentially > exploitable". Thus, it'd be better to change that to simply "fatal but That's not necessarily true. Especially not for a release. Typically you would hit if partial teardown on an initialization failure is incorrect. But that's not exploitable at all. > The bigger question, though, is the value of these checks in the first > place. Has anybody written a coccinelle check to look into this > statically? Has it historically been a useful thing for driver > developers to have? Is it good defense in depth or is it overkill? At > the very least, the original authors of kref thought a WARN_ON was > warranted, which means probably a BUG_ON is a sensible fix, until > somebody does the work of investigating these more careful questions. Right that's the question that should have been answered before this patch. I don't think it was ever intended to be a defense, just as a hint for driver developers. My suspicion is that they're mostly useless. -Andi