From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_IN_DEF_DKIM_WL autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D050EC432BE for ; Wed, 25 Aug 2021 21:55:35 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id B2511610CF for ; Wed, 25 Aug 2021 21:55:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232134AbhHYV4U (ORCPT ); Wed, 25 Aug 2021 17:56:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229707AbhHYV4S (ORCPT ); Wed, 25 Aug 2021 17:56:18 -0400 Received: from mail-lj1-x236.google.com (mail-lj1-x236.google.com [IPv6:2a00:1450:4864:20::236]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 150A2C061757 for ; Wed, 25 Aug 2021 14:55:31 -0700 (PDT) Received: by mail-lj1-x236.google.com with SMTP id s12so1298925ljg.0 for ; Wed, 25 Aug 2021 14:55:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jxSZH2j2eaq7YbJpNkogw+OvVkZIag0gCuTap1CAdjw=; b=kPYP3C82a/M7SugtamQJkWGW6tsr0GCoZasJjWGPGWn/2mFy0X292UYyt2jDo6E1HW SXiuK2kkURpEO3A4GKL/UNLg2p2nKC3s35L36EfI9HTEp9JqipvY2CbrnkSXWAgpvyJD byjSrQCBb+63UpNYs2OaAM0Qax3/FIjsbcHrEZhU3eHFhxlF48LMEH8wD0EikY1S86+n 5Ob8nqqP5DQ9N8GGMObnSVbNyOpphaxEYMAdt02FxxFuTTObWvVAQ/6lfCJUQrwH4wvh Qkxo3dv0IGM9C18cW1YXfYjbsM6X5U8mp7ejd+iDiF+/U7vb83w1+0C7qiguX6TQ+eIU a6PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jxSZH2j2eaq7YbJpNkogw+OvVkZIag0gCuTap1CAdjw=; b=aKhTSKHm8PUBZM7HYeGT/Qi1/hA374a7qkNv5vjk80SMV3jf18j96fYFyF1uCFISJT NyzRFlvCSX4wki75gcN1X15fMW3UZIVMt0XHtB2oDBBgMYAZXLrq9at5frxLfZePjIXE KkQ7eW0bONx7Bwx2E0alBuqcsfu3K11lm+3EK84mRFQ0olRxhKIxDLPZQEaFYBvjKzC9 BVcxIlZaSg1E1tZp62UiUo7Uo3bBfNZW5ybzIbmU+1c8j0cQ1eZA8NLlfD74Dv+L7Q1I llTUjWSvujHzv9W1o0oky0MocQJgBaFOx3BgKP6M1AexlpYEfZqXxphvXb2X0P1rUzx3 8xZw== X-Gm-Message-State: AOAM530T8Fd/V7q8VDH/cXvOhPzcA+QLojnhIizQ5rkDce16NALTyMjD ZU1h7BN6cqFzFXXDNpIykIUYrKKBKzwW6m5s977IdA== X-Google-Smtp-Source: ABdhPJxaGr9ffS+ETTZWl7jSA9yzFobVViTrobQlYBli7DBKBt0Qu750YeW7cWfUe4RwlxfOeeNAhe7MJaSJIgKZ/7g= X-Received: by 2002:a2e:a788:: with SMTP id c8mr321743ljf.116.1629928529265; Wed, 25 Aug 2021 14:55:29 -0700 (PDT) MIME-Version: 1.0 References: <20210822075122.864511-1-keescook@chromium.org> <20210822075122.864511-18-keescook@chromium.org> In-Reply-To: <20210822075122.864511-18-keescook@chromium.org> From: Nick Desaulniers Date: Wed, 25 Aug 2021 14:55:18 -0700 Message-ID: Subject: Re: [PATCH for-next 17/25] fortify: Fix dropped strcpy() compile-time write overflow check To: Kees Cook Cc: linux-kernel@vger.kernel.org, Daniel Axtens , Francis Laniel , Rasmus Villemoes , Daniel Micay , Bart Van Assche , David Gow , linux-mm@kvack.org, clang-built-linux@googlegroups.com, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Sun, Aug 22, 2021 at 12:57 AM Kees Cook wrote: > > The implementation for intra-object overflow in str*-family functions > accidentally dropped compile-time write overflow checking in strcpy(), > leaving it entirely to run-time. Add back the intended check. > > Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions") > Cc: Daniel Axtens > Cc: Francis Laniel > Signed-off-by: Kees Cook Reviewed-by: Nick Desaulniers > --- > include/linux/fortify-string.h | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h > index 7e67d02764db..68bc5978d916 100644 > --- a/include/linux/fortify-string.h > +++ b/include/linux/fortify-string.h > @@ -287,7 +287,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) > if (p_size == (size_t)-1 && q_size == (size_t)-1) > return __underlying_strcpy(p, q); > size = strlen(q) + 1; > - /* test here to use the more stringent object size */ > + /* Compile-time check for const size overflow. */ > + if (__builtin_constant_p(size) && p_size < size) > + __write_overflow(); > + /* Run-time check for dynamic size overflow. */ > if (p_size < size) > fortify_panic(__func__); > memcpy(p, q, size); > -- > 2.30.2 > > -- > You received this message because you are subscribed to the Google Groups "Clang Built Linux" group. > To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20210822075122.864511-18-keescook%40chromium.org. -- Thanks, ~Nick Desaulniers From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-23.3 required=3.0 tests=BAYES_00,DKIMWL_WL_MED, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER,INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_IN_DEF_DKIM_WL autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0009AC432BE for ; Wed, 25 Aug 2021 21:55:32 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id 87FD261052 for ; Wed, 25 Aug 2021 21:55:32 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.1 mail.kernel.org 87FD261052 Authentication-Results: mail.kernel.org; dmarc=fail (p=reject dis=none) header.from=google.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=kvack.org Received: by kanga.kvack.org (Postfix) id BF3C46B006C; Wed, 25 Aug 2021 17:55:31 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id BA4776B0072; Wed, 25 Aug 2021 17:55:31 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A92868D0001; Wed, 25 Aug 2021 17:55:31 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0074.hostedemail.com [216.40.44.74]) by kanga.kvack.org (Postfix) with ESMTP id 8CB666B006C for ; Wed, 25 Aug 2021 17:55:31 -0400 (EDT) Received: from smtpin18.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay03.hostedemail.com (Postfix) with ESMTP id 38E988249980 for ; Wed, 25 Aug 2021 21:55:31 +0000 (UTC) X-FDA: 78514960062.18.4B46733 Received: from mail-lj1-f172.google.com (mail-lj1-f172.google.com [209.85.208.172]) by imf09.hostedemail.com (Postfix) with ESMTP id ED20E300010F for ; Wed, 25 Aug 2021 21:55:30 +0000 (UTC) Received: by mail-lj1-f172.google.com with SMTP id m4so1181938ljq.8 for ; Wed, 25 Aug 2021 14:55:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=jxSZH2j2eaq7YbJpNkogw+OvVkZIag0gCuTap1CAdjw=; b=kPYP3C82a/M7SugtamQJkWGW6tsr0GCoZasJjWGPGWn/2mFy0X292UYyt2jDo6E1HW SXiuK2kkURpEO3A4GKL/UNLg2p2nKC3s35L36EfI9HTEp9JqipvY2CbrnkSXWAgpvyJD byjSrQCBb+63UpNYs2OaAM0Qax3/FIjsbcHrEZhU3eHFhxlF48LMEH8wD0EikY1S86+n 5Ob8nqqP5DQ9N8GGMObnSVbNyOpphaxEYMAdt02FxxFuTTObWvVAQ/6lfCJUQrwH4wvh Qkxo3dv0IGM9C18cW1YXfYjbsM6X5U8mp7ejd+iDiF+/U7vb83w1+0C7qiguX6TQ+eIU a6PA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=jxSZH2j2eaq7YbJpNkogw+OvVkZIag0gCuTap1CAdjw=; b=UCA6F2qwKCmwsIUmx4+Y3eE7jLpLoSFKvo0mXajaFPfDBpqqRoFfhawDgjujpGAyM/ dLs2KflhoITHfFxq3nXkVFG6Yd96qAiRgH07k3x/9lTI3/nRcAFuyCuQTVc4f5G9w9sr sRrwesGVPXeQGKG22cuuWrH983TZav9W2XoRZaif52NklfnnsMhs7DE6zFBLcyzYk6d7 vp9SxGr2hLTFsNNpzX8Yg9GP/95f2XFN2Vaq7kf5axT02OV6eDoppe1M+wHjfqhMw9fo vdgmo0LY9FeNd/6f8vm35prEplgBizvS/nYyPW146tYY3StCLJLyI++pMThJRqKVNN4L iOBg== X-Gm-Message-State: AOAM5302aknwi4N25O7thxAiYvGtkByoNXAOJ/H2fE3UhoRy2Sh6gxuc qvtCtBRS0dPj2jm2MIO/3XmPdJa6ymbU0JfG5KAY1Q== X-Google-Smtp-Source: ABdhPJxaGr9ffS+ETTZWl7jSA9yzFobVViTrobQlYBli7DBKBt0Qu750YeW7cWfUe4RwlxfOeeNAhe7MJaSJIgKZ/7g= X-Received: by 2002:a2e:a788:: with SMTP id c8mr321743ljf.116.1629928529265; Wed, 25 Aug 2021 14:55:29 -0700 (PDT) MIME-Version: 1.0 References: <20210822075122.864511-1-keescook@chromium.org> <20210822075122.864511-18-keescook@chromium.org> In-Reply-To: <20210822075122.864511-18-keescook@chromium.org> From: Nick Desaulniers Date: Wed, 25 Aug 2021 14:55:18 -0700 Message-ID: Subject: Re: [PATCH for-next 17/25] fortify: Fix dropped strcpy() compile-time write overflow check To: Kees Cook Cc: linux-kernel@vger.kernel.org, Daniel Axtens , Francis Laniel , Rasmus Villemoes , Daniel Micay , Bart Van Assche , David Gow , linux-mm@kvack.org, clang-built-linux@googlegroups.com, linux-hardening@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Authentication-Results: imf09.hostedemail.com; dkim=pass header.d=google.com header.s=20161025 header.b=kPYP3C82; spf=pass (imf09.hostedemail.com: domain of ndesaulniers@google.com designates 209.85.208.172 as permitted sender) smtp.mailfrom=ndesaulniers@google.com; dmarc=pass (policy=reject) header.from=google.com X-Rspamd-Server: rspam02 X-Rspamd-Queue-Id: ED20E300010F X-Stat-Signature: da6tw8p43cmwkb7n5egwkpru4zkrmqr9 X-HE-Tag: 1629928530-698337 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, Aug 22, 2021 at 12:57 AM Kees Cook wrote: > > The implementation for intra-object overflow in str*-family functions > accidentally dropped compile-time write overflow checking in strcpy(), > leaving it entirely to run-time. Add back the intended check. > > Fixes: 6a39e62abbaf ("lib: string.h: detect intra-object overflow in fortified string functions") > Cc: Daniel Axtens > Cc: Francis Laniel > Signed-off-by: Kees Cook Reviewed-by: Nick Desaulniers > --- > include/linux/fortify-string.h | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/include/linux/fortify-string.h b/include/linux/fortify-string.h > index 7e67d02764db..68bc5978d916 100644 > --- a/include/linux/fortify-string.h > +++ b/include/linux/fortify-string.h > @@ -287,7 +287,10 @@ __FORTIFY_INLINE char *strcpy(char *p, const char *q) > if (p_size == (size_t)-1 && q_size == (size_t)-1) > return __underlying_strcpy(p, q); > size = strlen(q) + 1; > - /* test here to use the more stringent object size */ > + /* Compile-time check for const size overflow. */ > + if (__builtin_constant_p(size) && p_size < size) > + __write_overflow(); > + /* Run-time check for dynamic size overflow. */ > if (p_size < size) > fortify_panic(__func__); > memcpy(p, q, size); > -- > 2.30.2 > > -- > You received this message because you are subscribed to the Google Groups "Clang Built Linux" group. > To unsubscribe from this group and stop receiving emails from it, send an email to clang-built-linux+unsubscribe@googlegroups.com. > To view this discussion on the web visit https://groups.google.com/d/msgid/clang-built-linux/20210822075122.864511-18-keescook%40chromium.org. -- Thanks, ~Nick Desaulniers