linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] string.h: work around __builtin_constant_p quirk
@ 2017-08-07 11:15 Arnd Bergmann
  2017-08-07 22:29 ` Arnd Bergmann
  2017-08-09  6:09 ` kbuild test robot
  0 siblings, 2 replies; 4+ messages in thread
From: Arnd Bergmann @ 2017-08-07 11:15 UTC (permalink / raw)
  To: Kees Cook, Andrew Morton, Daniel Micay
  Cc: Arnd Bergmann, Dan Williams, David Howells, linux-kernel

The compile-time check in the hardened memcpy() triggered a build
error in code that should not have:

In function 'memcpy',
    inlined from '__adfs_dir_put' at fs/adfs/dir_f.c:318:2,
    inlined from 'adfs_f_update' at fs/adfs/dir_f.c:403:2:
include/linux/string.h:305:4: error: call to '__read_overflow2' declared with attribute error: detected read beyond size of object passed as 2nd parameter
    __read_overflow2();
    ^~~~~~~~~~~~~~~~~~

My understanding is that in the __adfs_dir_put() function, the gcc
uses a specialization for the common 'thissize = 26', which due to
jump threading leads to a case where it has shown that 'thissize'
can be constant, but at the same time another case exists where
it may have a negative value (for sb->s_blocksize=0) that could lead
to overflowing the local 'adfs_direntry de' variable.

The bug was hidden before patch "fortify: use WARN instead of BUG
for now", which apparently dropped the compile-time checks due to
the following code being marked as '__unreachable'.

This reworks the hardened string functions to avoid some branches,
and introduces a macro for checking whether the argument is a
compile-time constant.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
Fixes: mmotm ("fortify: use WARN instead of BUG for now")
Fixes: 6974f0c4555e ("include/linux/string.h: add the option of fortified string.h functions")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
 include/linux/string.h | 62 ++++++++++++++++++++++++++++++--------------------
 1 file changed, 37 insertions(+), 25 deletions(-)

diff --git a/include/linux/string.h b/include/linux/string.h
index 25f47e07c4c6..3ba29007a942 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -203,10 +203,19 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob
 void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter");
 
 #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
+
+/*
+ * a more reliable check for constant arguments, see
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
+ */
+#define __constant_argument(arg) \
+	__builtin_choose_expr(__builtin_constant_p(arg), (arg), 0)
+
 __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__write_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
@@ -257,7 +266,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
 	ret = strlen(q);
 	if (size) {
 		size_t len = (ret >= size) ? size - 1 : ret;
-		if (__builtin_constant_p(len) && len >= p_size)
+		size_t constlen = __constant_argument(len);
+		if (constlen >= p_size)
 			__write_overflow();
 		if (len >= p_size)
 			fortify_overflow(__func__);
@@ -287,7 +297,8 @@ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)
 __FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__write_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
@@ -298,12 +309,11 @@ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
 	size_t q_size = __builtin_object_size(q, 0);
-	if (__builtin_constant_p(size)) {
-		if (p_size < size)
-			__write_overflow();
-		if (q_size < size)
-			__read_overflow2();
-	}
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
+		__write_overflow();
+	if (q_size < constsize)
+		__read_overflow2();
 	if (p_size < size || q_size < size)
 		fortify_overflow(__func__);
 	return __builtin_memcpy(p, q, size);
@@ -313,12 +323,11 @@ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
 	size_t q_size = __builtin_object_size(q, 0);
-	if (__builtin_constant_p(size)) {
-		if (p_size < size)
-			__write_overflow();
-		if (q_size < size)
-			__read_overflow2();
-	}
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
+		__write_overflow();
+	if (q_size < constsize)
+		__read_overflow2();
 	if (p_size < size || q_size < size)
 		fortify_overflow(__func__);
 	return __builtin_memmove(p, q, size);
@@ -328,7 +337,8 @@ extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan);
 __FORTIFY_INLINE void *memscan(void *p, int c, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__read_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
@@ -339,12 +349,11 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
 	size_t q_size = __builtin_object_size(q, 0);
-	if (__builtin_constant_p(size)) {
-		if (p_size < size)
-			__read_overflow();
-		if (q_size < size)
-			__read_overflow2();
-	}
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
+		__read_overflow();
+	if (q_size < constsize)
+		__read_overflow2();
 	if (p_size < size || q_size < size)
 		fortify_overflow(__func__);
 	return __builtin_memcmp(p, q, size);
@@ -353,7 +362,8 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)
 __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__read_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
@@ -364,7 +374,8 @@ void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv);
 __FORTIFY_INLINE void *memchr_inv(const void *p, int c, size_t size)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__read_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
@@ -375,7 +386,8 @@ extern void *__real_kmemdup(const void *src, size_t len, gfp_t gfp) __RENAME(kme
 __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)
 {
 	size_t p_size = __builtin_object_size(p, 0);
-	if (__builtin_constant_p(size) && p_size < size)
+	size_t constsize = __constant_argument(size);
+	if (p_size < constsize)
 		__read_overflow();
 	if (p_size < size)
 		fortify_overflow(__func__);
-- 
2.9.0

^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-08-15 19:07 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-08-07 11:15 [PATCH] string.h: work around __builtin_constant_p quirk Arnd Bergmann
2017-08-07 22:29 ` Arnd Bergmann
2017-08-15 19:07   ` Kees Cook
2017-08-09  6:09 ` kbuild test robot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).