Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1535875700.17858.3.camel@med.uni-goettingen.de>
 <CAGXu5jJ7kGm-DGUB8uwwhd-Hv7i4WEcSKumTf2MBsj_-yzWcqg@mail.gmail.com> <1535960372.32005.1.camel@med.uni-goettingen.de>
In-Reply-To: <1535960372.32005.1.camel@med.uni-goettingen.de>
From:   Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon, 3 Sep 2018 14:28:59 -0700
Message-ID: <CA+55aFy=T6TmG_VcLvSTb02RyKTacxVCxwUALRn8_7cdoic0pA@mail.gmail.com>
Subject: Re: VLAs and security
To:     "Uecker, Martin" <Martin.Uecker@med.uni-goettingen.de>
Cc:     Kees Cook <keescook@chromium.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Sep 3, 2018 at 12:40 AM Uecker, Martin
<Martin.Uecker@med.uni-goettingen.de> wrote:
>
> But if the true bound is smaller, then IMHO it is really bad advise
> to tell programmers to use
>
> char buf[MAX_SIZE]
>
> instead of something like
>
> assert(N <= MAX_SIZE);
> char buf[N]

No.

First off, we don't use asserts in the kernel. Not acceptable. You
handle errors, you don't crash.

Secondly, the compiler is usually very stupid, and will generate
horrible code for VLA's.

Third, there's no guarantee that the compiler will actually even
realize that the size is limited, and guarantee that it won't screw up
the stack.

So no. VLA's are not acceptable in the kernel. Don't do them. We're
getting rid of them.

               Linus