Re: [PATCH] kref: Avoid null pointer dereference after WARN

[Andi Kleen]

On Tue, Jun 27, 2017 at 09:11:28PM +0200, Jason A. Donenfeld wrote:
> On Tue, Jun 27, 2017 at 4:49 PM, Andi Kleen <ak@xxxxxxxxxxxxxxx> wrote:
> > Is there any data how many security holes this would have
> > caught? Please no hand waving. A lot of the recent
> > security patches seem to have gone in with just a lot of
> > hand waving and security theater
> 
> I don't practice security theater. What an offensive insinuation.
> Maybe you just meant this about other patches, however.

I'm not naming names, but there was a recent patch
that seemed to have fixed one very extremely specific bug,
but made every kernel exit forever slower.

That was a classic case IMHO -- the Linux equivalent of
shoes at airport checkpoints.

> The point was that if there prior was a WARN_ON, this needs to be a
> BUG_ON, since if the WARN_ON was put there with any validity,
> continuing after it will always be "fatal and potentially
> exploitable". Thus, it'd be better to change that to simply "fatal but

That's not necessarily true. Especially not for a release.
Typically you would hit if partial teardown on an initialization
failure is incorrect. But that's not exploitable at all.

> The bigger question, though, is the value of these checks in the first
> place. Has anybody written a coccinelle check to look into this
> statically? Has it historically been a useful thing for driver
> developers to have? Is it good defense in depth or is it overkill? At
> the very least, the original authors of kref thought a WARN_ON was
> warranted, which means probably a BUG_ON is a sensible fix, until
> somebody does the work of investigating these more careful questions.

Right that's the question that should have been answered before
this patch.

I don't think it was ever intended to be a defense, just as a hint
for driver developers.

My suspicion is that they're mostly useless.

-Andi