From: Kees Cook <keescook@chromium.org>
To: Christoph Lameter <cl@gentwo.de>
Cc: Daniel Micay <danielmicay@gmail.com>,
Christoph Hellwig <hch@infradead.org>,
kernel list <linux-kernel@vger.kernel.org>,
Andrew Morton <akpm@linux-foundation.org>,
Miguel Ojeda <ojeda@kernel.org>,
Nathan Chancellor <nathan@kernel.org>,
Nick Desaulniers <ndesaulniers@google.com>,
Pekka Enberg <penberg@kernel.org>,
David Rientjes <rientjes@google.com>,
Joonsoo Kim <iamjoonsoo.kim@lge.com>,
Vlastimil Babka <vbabka@suse.cz>, Dennis Zhou <dennis@kernel.org>,
Tejun Heo <tj@kernel.org>, Masahiro Yamada <masahiroy@kernel.org>,
Michal Marek <michal.lkml@markovi.net>,
clang-built-linux@googlegroups.com, Linux-MM <linux-mm@kvack.org>,
linux-kbuild <linux-kbuild@vger.kernel.org>,
linux-hardening@vger.kernel.org
Subject: Re: [PATCH 0/5] Add __alloc_size() for better bounds checking
Date: Wed, 25 Aug 2021 09:34:01 -0700 [thread overview]
Message-ID: <202108250930.EED99F6@keescook> (raw)
In-Reply-To: <alpine.DEB.2.22.394.2108251158420.317806@gentwo.de>
On Wed, Aug 25, 2021 at 12:01:42PM +0200, Christoph Lameter wrote:
> On Thu, 19 Aug 2021, Daniel Micay wrote:
>
> > For example, it will know that kmalloc(n) returns either NULL or an
> > allocation of size n. A simple sample program with calloc in
> > userspace:
> >
> > #include <stdlib.h>
> > #include <stdio.h>
> >
> > int main(void) {
> > char *p = calloc(64, 1);
> > if (!p) {
> > return 1;
> > }
> > printf("%zu\n", __builtin_object_size(p, 1));
> > return 0;
> > }
> >
> > It will also detect an out-of-bounds access via the allocation with
> > -fsanitize=object-size including with a runtime value as the index.
> >
> > It's not as useful as it should be yet because __builtin_object_size
> > must return a compile-time constant. Clang has a new
> > __builtin_dynamic_object_size that's allowed to return a value that's
> > not a compile-time constant so it can work for kmalloc(n) where n is a
> > runtime value. It might not be quite ready for use yet but it should
> > be able to make it a lot more useful. GCC also seems open to adding it
> > too.
>
> The other complication with kmalloc etc is that the slab allocators may
> decided to allocate more bytes than needed because it does not support
> that particular allocation size. Some functions check the allocated true
> size and make use of that. See ksize().
Yup, this is known. For the current iteration, this doesn't pose a
problem since the compile-time checking has very limited scope.
--
Kees Cook
prev parent reply other threads:[~2021-08-25 16:34 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-18 5:08 [PATCH 0/5] Add __alloc_size() for better bounds checking Kees Cook
2021-08-18 5:08 ` [PATCH 1/5] Compiler Attributes: " Kees Cook
2021-08-18 13:07 ` Miguel Ojeda
2021-08-18 17:58 ` Kees Cook
2021-08-18 18:04 ` Nathan Chancellor
2021-08-18 21:04 ` Kees Cook
2021-08-18 5:08 ` [PATCH 2/5] slab: Add __alloc_size attributes " Kees Cook
2021-08-18 5:31 ` Joe Perches
2021-08-18 6:16 ` Kees Cook
2021-08-18 6:30 ` Joe Perches
2021-08-19 0:27 ` Matthew Wilcox
2021-08-19 1:10 ` Joe Perches
2021-08-19 2:16 ` Matthew Wilcox
2021-08-19 2:59 ` Joe Perches
2021-08-18 5:08 ` [PATCH 3/5] mm/page_alloc: " Kees Cook
2021-08-18 5:08 ` [PATCH 4/5] percpu: " Kees Cook
2021-08-18 5:08 ` [PATCH 5/5] mm/vmalloc: " Kees Cook
2021-08-19 9:09 ` [PATCH 0/5] Add __alloc_size() " Christoph Hellwig
2021-08-19 14:18 ` Daniel Micay
2021-08-25 10:01 ` Christoph Lameter
2021-08-25 16:34 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202108250930.EED99F6@keescook \
--to=keescook@chromium.org \
--cc=akpm@linux-foundation.org \
--cc=cl@gentwo.de \
--cc=clang-built-linux@googlegroups.com \
--cc=danielmicay@gmail.com \
--cc=dennis@kernel.org \
--cc=hch@infradead.org \
--cc=iamjoonsoo.kim@lge.com \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kbuild@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=masahiroy@kernel.org \
--cc=michal.lkml@markovi.net \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=ojeda@kernel.org \
--cc=penberg@kernel.org \
--cc=rientjes@google.com \
--cc=tj@kernel.org \
--cc=vbabka@suse.cz \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).