On Tue, Jun 18, 2024 at 10:45:48AM +0200, Peter Zijlstra wrote: > On Tue, Jun 18, 2024 at 02:12:40AM +0200, Jason A. Donenfeld wrote: > > Hi Andy, > > > > On Mon, Jun 17, 2024 at 05:06:22PM -0700, Andy Lutomirski wrote: > > > On Fri, Jun 14, 2024 at 12:08 PM Jason A. Donenfeld <Jason@xxxxxxxxx> wrote: > > > > > > > > Provide a generic C vDSO getrandom() implementation, which operates on > > > > an opaque state returned by vgetrandom_alloc() and produces random bytes > > > > the same way as getrandom(). This has a the API signature: > > > > > > > > ssize_t vgetrandom(void *buffer, size_t len, unsigned int flags, void *opaque_state); > > > > > > Last time around, I mentioned some potential issues with this function > > > signature, and I didn't see any answer. My specific objection was to > > > the fact that the caller passes in a pointer but not a length, and > > > this potentially makes reasoning about memory safety awkward, > > > especially if anything like CRIU is involved. > > > > Oh, I understood this backwards last time - I thought you were > > criticizing the size_t len argument, which didn't make any sense. > > > > Re-reading now, what you're suggesting is that I add an additional > > argument called `size_t opaque_len`, and then the implementation does > > something like: > > Exactly, that's how I read amluto's suggestion as well. Also, I recently > ran into this clang rfc: > > https://discourse.llvm.org/t/rfc-enforcing-bounds-safety-in-c-fbounds-safety/70854 Alright, I'll have this for v+1. Patches already written now, for both kernel and libc, and I'm dogfooding it. Jason
