From: Rasmus Villemoes <linux@rasmusvillemoes.dk> To: Josh Poimboeuf <jpoimboe@redhat.com>, Kees Cook <keescook@chromium.org> Cc: Andrew Morton <akpm@linux-foundation.org>, linux-kernel@vger.kernel.org, corbet@lwn.net, gustavo@embeddedor.com, rostedt@goodmis.org, Chris Mason <clm@fb.com>, Josef Bacik <jbacik@fb.com>, David Sterba <dsterba@suse.com>, "David S. Miller" <davem@davemloft.net>, Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>, Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>, Ingo Molnar <mingo@kernel.org>, Peter Zijlstra <peterz@infradead.org>, Thomas Gleixner <tglx@linutronix.de>, Masahiro Yamada <yamada.masahiro@socionext.com>, Borislav Petkov <bp@suse.de>, Randy Dunlap <rdunlap@infradead.org>, Ian Abbott <abbotti@mev.co.uk>, "Tobin C. Harding" <me@tobin.cc>, Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>, Petr Mladek <pmladek@suse.com>, Andy Shevchenko <andriy.shevchenko@linux.intel.com>, Pantelis Antoniou <pantelis.antoniou@konsulko.com>, linux-btrfs@vger.kernel.org, netdev@vger.kernel.org, kernel-hardening@lists.openwall.com Subject: Re: [PATCH 0/3] Remove accidental VLA usage Date: Thu, 8 Mar 2018 20:57:16 +0100 [thread overview] Message-ID: <78428dec-270e-5d74-0160-83feb5c0ff02@rasmusvillemoes.dk> (raw) In-Reply-To: <20180308150236.5tysfbm3xdouii5n@treble> On 2018-03-08 16:02, Josh Poimboeuf wrote: > On Wed, Mar 07, 2018 at 07:30:44PM -0800, Kees Cook wrote: >> This series adds SIMPLE_MAX() to be used in places where a stack array >> is actually fixed, but the compiler still warns about VLA usage due to >> confusion caused by the safety checks in the max() macro. >> >> I'm sending these via -mm since that's where I've introduced SIMPLE_MAX(), >> and they should all have no operational differences. > > What if we instead simplify the max() macro's type checking so that GCC > can more easily fold the array size constants? The below patch seems to > work: > > +extern long __error_incompatible_types_in_min_macro; > +extern long __error_incompatible_types_in_max_macro; > + > +#define __min(t1, t2, x, y) \ > + __builtin_choose_expr(__builtin_types_compatible_p(t1, t2), \ > + (t1)(x) < (t2)(y) ? (t1)(x) : (t2)(y), \ > + (t1)__error_incompatible_types_in_min_macro) > > /** > * min - return minimum of two values of the same or compatible types > * @x: first value > * @y: second value > */ > -#define min(x, y) \ > - __min(typeof(x), typeof(y), \ > - __UNIQUE_ID(min1_), __UNIQUE_ID(min2_), \ > - x, y) > +#define min(x, y) __min(typeof(x), typeof(y), x, y) \ > But this introduces the the-chosen-one-of-x-and-y-gets-evaluated-twice problem. Maybe we don't care? But until we get a __builtin_assert_this_has_no_side_effects() I think that's a little dangerous. Rasmus
WARNING: multiple messages have this Message-ID (diff)
From: Rasmus Villemoes <linux@rasmusvillemoes.dk> To: Josh Poimboeuf <jpoimboe@redhat.com>, Kees Cook <keescook@chromium.org> Cc: Andrew Morton <akpm@linux-foundation.org>, linux-kernel@vger.kernel.org, corbet@lwn.net, gustavo@embeddedor.com, rostedt@goodmis.org, Chris Mason <clm@fb.com>, Josef Bacik <jbacik@fb.com>, David Sterba <dsterba@suse.com>, "David S. Miller" <davem@davemloft.net>, Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>, Hideaki YOSHIFUJI <yoshfuji@linux-ipv6.org>, Ingo Molnar <mingo@kernel.org>, Peter Zijlstra <peterz@infradead.org>, Thomas Gleixner <tglx@linutronix.de>, Masahiro Yamada <yamada.masahiro@socionext.com>, Borislav Petkov <bp@suse.de>, Randy Dunlap <rdunlap@infradead.org>, Ian Abbott <abbotti@mev.co.uk>, "Tobin C. Harding" <me@tobin.cc>, Sergey Senozhatsky <sergey.senozhatsky.work@gmail.com>, Petr Mladek <pmladek@suse.com>, Andy Shevchenko <andriy Subject: Re: [PATCH 0/3] Remove accidental VLA usage Date: Thu, 8 Mar 2018 20:57:16 +0100 [thread overview] Message-ID: <78428dec-270e-5d74-0160-83feb5c0ff02@rasmusvillemoes.dk> (raw) In-Reply-To: <20180308150236.5tysfbm3xdouii5n@treble> On 2018-03-08 16:02, Josh Poimboeuf wrote: > On Wed, Mar 07, 2018 at 07:30:44PM -0800, Kees Cook wrote: >> This series adds SIMPLE_MAX() to be used in places where a stack array >> is actually fixed, but the compiler still warns about VLA usage due to >> confusion caused by the safety checks in the max() macro. >> >> I'm sending these via -mm since that's where I've introduced SIMPLE_MAX(), >> and they should all have no operational differences. > > What if we instead simplify the max() macro's type checking so that GCC > can more easily fold the array size constants? The below patch seems to > work: > > +extern long __error_incompatible_types_in_min_macro; > +extern long __error_incompatible_types_in_max_macro; > + > +#define __min(t1, t2, x, y) \ > + __builtin_choose_expr(__builtin_types_compatible_p(t1, t2), \ > + (t1)(x) < (t2)(y) ? (t1)(x) : (t2)(y), \ > + (t1)__error_incompatible_types_in_min_macro) > > /** > * min - return minimum of two values of the same or compatible types > * @x: first value > * @y: second value > */ > -#define min(x, y) \ > - __min(typeof(x), typeof(y), \ > - __UNIQUE_ID(min1_), __UNIQUE_ID(min2_), \ > - x, y) > +#define min(x, y) __min(typeof(x), typeof(y), x, y) \ > But this introduces the the-chosen-one-of-x-and-y-gets-evaluated-twice problem. Maybe we don't care? But until we get a __builtin_assert_this_has_no_side_effects() I think that's a little dangerous. Rasmus
next prev parent reply other threads:[~2018-03-08 19:57 UTC|newest] Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-03-08 3:30 [PATCH 0/3] Remove accidental VLA usage Kees Cook 2018-03-08 3:30 ` Kees Cook 2018-03-08 3:30 ` [PATCH v2 1/3] vsprintf: " Kees Cook 2018-03-08 3:30 ` Kees Cook 2018-03-08 8:25 ` Rasmus Villemoes 2018-03-08 8:25 ` Rasmus Villemoes 2018-03-08 11:21 ` Thomas Gleixner 2018-03-08 11:21 ` Thomas Gleixner 2018-03-08 3:30 ` [PATCH 2/3] net: Remove accidental VLAs from proc buffers Kees Cook 2018-03-08 3:30 ` Kees Cook 2018-03-08 3:30 ` [PATCH 3/3] btrfs: tree-checker: Avoid accidental stack VLA Kees Cook 2018-03-08 3:30 ` Kees Cook 2018-03-08 11:33 ` David Sterba 2018-03-08 11:33 ` David Sterba 2018-03-08 15:02 ` [PATCH 0/3] Remove accidental VLA usage Josh Poimboeuf 2018-03-08 15:02 ` Josh Poimboeuf 2018-03-08 18:02 ` Kees Cook 2018-03-08 18:02 ` Kees Cook 2018-03-08 18:11 ` Josh Poimboeuf 2018-03-08 18:11 ` Josh Poimboeuf 2018-03-08 18:06 ` Steven Rostedt 2018-03-08 18:06 ` Steven Rostedt 2018-03-08 19:57 ` Rasmus Villemoes [this message] 2018-03-08 19:57 ` Rasmus Villemoes 2018-03-08 20:39 ` Kees Cook 2018-03-08 20:39 ` Kees Cook 2018-03-08 22:12 ` Rasmus Villemoes 2018-03-08 22:12 ` Rasmus Villemoes 2018-03-08 23:33 ` Kees Cook 2018-03-08 23:33 ` Kees Cook 2018-03-08 20:49 ` Andrew Morton 2018-03-08 20:49 ` Andrew Morton
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=78428dec-270e-5d74-0160-83feb5c0ff02@rasmusvillemoes.dk \ --to=linux@rasmusvillemoes.dk \ --cc=abbotti@mev.co.uk \ --cc=akpm@linux-foundation.org \ --cc=andriy.shevchenko@linux.intel.com \ --cc=bp@suse.de \ --cc=clm@fb.com \ --cc=corbet@lwn.net \ --cc=davem@davemloft.net \ --cc=dsterba@suse.com \ --cc=gustavo@embeddedor.com \ --cc=jbacik@fb.com \ --cc=jpoimboe@redhat.com \ --cc=keescook@chromium.org \ --cc=kernel-hardening@lists.openwall.com \ --cc=kuznet@ms2.inr.ac.ru \ --cc=linux-btrfs@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=me@tobin.cc \ --cc=mingo@kernel.org \ --cc=netdev@vger.kernel.org \ --cc=pantelis.antoniou@konsulko.com \ --cc=peterz@infradead.org \ --cc=pmladek@suse.com \ --cc=rdunlap@infradead.org \ --cc=rostedt@goodmis.org \ --cc=sergey.senozhatsky.work@gmail.com \ --cc=tglx@linutronix.de \ --cc=yamada.masahiro@socionext.com \ --cc=yoshfuji@linux-ipv6.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.