From: Rasmus Villemoes <linux@rasmusvillemoes.dk> To: kernel-hardening@lists.openwall.com Cc: linux-kernel@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Rasmus Villemoes <linux@rasmusvillemoes.dk> Subject: [RFC 3/6] compiler.h: add __attribute__((format_arg)) shorthand Date: Wed, 8 Nov 2017 23:30:17 +0100 [thread overview] Message-ID: <20171108223020.24487-4-linux@rasmusvillemoes.dk> (raw) In-Reply-To: <20171108223020.24487-1-linux@rasmusvillemoes.dk> The __format_arg attribute tells gcc that it can use a specific argument to the annotated function as the format string for the purpose of type-checking a surrounding __printf function call, e.g. sprintf(buf, fmtcheck(what->ever, "%d %lx", 0), i, m) makes gcc check that i and m are indeed an int and a long; with sprintf(buf, what->ever, i, m) the compiler cannot do any type checking. Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> --- include/linux/compiler-gcc.h | 1 + include/linux/compiler.h | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index bb78e5bdff26..69a233f9fa26 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -128,6 +128,7 @@ #define __maybe_unused __attribute__((unused)) #define __always_unused __attribute__((unused)) #define __mode(x) __attribute__((mode(x))) +#define __format_arg(n) __attribute__((format_arg(n))) /* gcc version specific checks */ diff --git a/include/linux/compiler.h b/include/linux/compiler.h index 478914ad280b..2c8793f72fb0 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -631,4 +631,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s #define __format_template(x) #endif +#ifndef __format_arg +#define __format_arg(n) +#endif + #endif /* __LINUX_COMPILER_H */ -- 2.11.0
WARNING: multiple messages have this Message-ID (diff)
From: Rasmus Villemoes <linux@rasmusvillemoes.dk> To: kernel-hardening@lists.openwall.com Cc: linux-kernel@vger.kernel.org, Andrew Morton <akpm@linux-foundation.org>, Kees Cook <keescook@chromium.org>, Rasmus Villemoes <linux@rasmusvillemoes.dk> Subject: [kernel-hardening] [RFC 3/6] compiler.h: add __attribute__((format_arg)) shorthand Date: Wed, 8 Nov 2017 23:30:17 +0100 [thread overview] Message-ID: <20171108223020.24487-4-linux@rasmusvillemoes.dk> (raw) In-Reply-To: <20171108223020.24487-1-linux@rasmusvillemoes.dk> The __format_arg attribute tells gcc that it can use a specific argument to the annotated function as the format string for the purpose of type-checking a surrounding __printf function call, e.g. sprintf(buf, fmtcheck(what->ever, "%d %lx", 0), i, m) makes gcc check that i and m are indeed an int and a long; with sprintf(buf, what->ever, i, m) the compiler cannot do any type checking. Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> --- include/linux/compiler-gcc.h | 1 + include/linux/compiler.h | 4 ++++ 2 files changed, 5 insertions(+) diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h index bb78e5bdff26..69a233f9fa26 100644 --- a/include/linux/compiler-gcc.h +++ b/include/linux/compiler-gcc.h @@ -128,6 +128,7 @@ #define __maybe_unused __attribute__((unused)) #define __always_unused __attribute__((unused)) #define __mode(x) __attribute__((mode(x))) +#define __format_arg(n) __attribute__((format_arg(n))) /* gcc version specific checks */ diff --git a/include/linux/compiler.h b/include/linux/compiler.h index 478914ad280b..2c8793f72fb0 100644 --- a/include/linux/compiler.h +++ b/include/linux/compiler.h @@ -631,4 +631,8 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s #define __format_template(x) #endif +#ifndef __format_arg +#define __format_arg(n) +#endif + #endif /* __LINUX_COMPILER_H */ -- 2.11.0
next prev parent reply other threads:[~2017-11-08 22:30 UTC|newest] Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-11-08 22:30 [RFC 0/6] some compile- and run-time format checking Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 1/6] plugins: implement format_template attribute Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 2/6] compiler.h: add __format_template Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` Rasmus Villemoes [this message] 2017-11-08 22:30 ` [kernel-hardening] [RFC 3/6] compiler.h: add __attribute__((format_arg)) shorthand Rasmus Villemoes 2017-11-08 22:30 ` [RFC 4/6] lib/vsprintf.c: add fmtcheck utility Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-09 1:08 ` Kees Cook 2017-11-09 1:08 ` [kernel-hardening] " Kees Cook 2017-11-08 22:30 ` [RFC 5/6] kernel.h: implement fmtmatch() wrapper around fmtcheck() Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-08 22:30 ` [RFC 6/6] lib/test_printf.c: add a few fmtcheck() test cases Rasmus Villemoes 2017-11-08 22:30 ` [kernel-hardening] " Rasmus Villemoes 2017-11-09 1:11 ` [RFC 0/6] some compile- and run-time format checking Kees Cook 2017-11-09 1:11 ` [kernel-hardening] " Kees Cook 2017-11-09 14:08 ` Rasmus Villemoes 2017-11-09 14:08 ` [kernel-hardening] " Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 0/7] runtime format string checking Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 1/7] compiler_attributes.h: add __attribute__((format_arg)) shorthand Rasmus Villemoes 2018-10-27 12:06 ` Miguel Ojeda 2018-10-29 10:20 ` Rasmus Villemoes 2018-10-29 19:17 ` Miguel Ojeda 2018-11-02 10:36 ` Miguel Ojeda 2018-11-02 10:43 ` Rasmus Villemoes 2019-01-09 10:57 ` Miguel Ojeda 2018-10-26 23:24 ` [RFC PATCH 2/7] lib/vsprintf.c: add fmtcheck utility Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 3/7] kernel.h: implement fmtmatch() wrapper around fmtcheck() Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 4/7] lib/test_printf.c: add a few fmtcheck() test cases Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 5/7] kernel/kthread.c: do runtime check of format string in kthread_create_on_cpu() Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 6/7] nfs: use fmtcheck() in root_nfs_data Rasmus Villemoes 2018-10-26 23:24 ` [RFC PATCH 7/7] drivers: hwmon: add runtime format string checking Rasmus Villemoes 2018-10-27 17:44 ` Guenter Roeck 2018-10-30 20:58 ` [RFC PATCH 0/7] " Kees Cook 2018-11-01 22:06 ` Rasmus Villemoes 2018-11-01 22:57 ` Kees Cook 2018-11-02 20:09 ` Rasmus Villemoes 2018-11-02 20:46 ` Kees Cook 2018-11-05 9:33 ` Rasmus Villemoes
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20171108223020.24487-4-linux@rasmusvillemoes.dk \ --to=linux@rasmusvillemoes.dk \ --cc=akpm@linux-foundation.org \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=linux-kernel@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.