linux-kernel - Re: [PATCH] fortify: Avoid panic() in favor of BUG()

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 27 Jun 2017 12:16:12 -0700
From:   Kees Cook <keescook@...omium.org>
To:     kbuild test robot <lkp@...el.com>,
        Yoshinori Sato <ysato@...rs.sourceforge.jp>,
        Rich Felker <dalias@...c.org>,
        linux-sh <linux-sh@...r.kernel.org>
Cc:     kbuild-all@...org, Andrew Morton <akpm@...ux-foundation.org>,
        Jonathan Corbet <corbet@....net>,
        Mika Westerberg <mika.westerberg@...ux.intel.com>,
        Bjorn Helgaas <bhelgaas@...gle.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Heikki Krogerus <heikki.krogerus@...ux.intel.com>,
        Daniel Micay <danielmicay@...il.com>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] fortify: Avoid panic() in favor of BUG()

On Tue, Jun 27, 2017 at 8:52 AM, kbuild test robot <lkp@...el.com> wrote:
> Hi Kees,
>
> [auto build test WARNING on next-20170619]
> [cannot apply to linus/master linux/master v4.12-rc6 v4.12-rc5 v4.12-rc4 v4.12-rc7]
> [if your patch is applied to the wrong git tree, please drop us a note to help improve the system]
>
> url:    https://github.com/0day-ci/linux/commits/Kees-Cook/fortify-Avoid-panic-in-favor-of-BUG/20170627-230653
> config: sh-allyesconfig (attached as .config)
> compiler: sh4-linux-gnu-gcc (Debian 6.1.1-9) 6.1.1 20160705
> reproduce:
>         wget https://raw.githubusercontent.com/01org/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # save the attached .config to linux build tree
>         make.cross ARCH=sh
>
> All warnings (new ones prefixed by >>):
>
>    lib/string.c: In function 'fortify_panic':
>>> lib/string.c:986:1: warning: 'noreturn' function does return
>     }
>     ^
>
> vim +/noreturn +986 lib/string.c
>
> 94df2904 Rasmus Villemoes 2015-06-25  970   *
> 94df2904 Rasmus Villemoes 2015-06-25  971   * Returns pointer to the nul byte at the end of @s.
> 94df2904 Rasmus Villemoes 2015-06-25  972   */
> 94df2904 Rasmus Villemoes 2015-06-25  973  char *strreplace(char *s, char old, char new)
> 94df2904 Rasmus Villemoes 2015-06-25  974  {
> 94df2904 Rasmus Villemoes 2015-06-25  975       for (; *s; ++s)
> 94df2904 Rasmus Villemoes 2015-06-25  976               if (*s == old)
> 94df2904 Rasmus Villemoes 2015-06-25  977                       *s = new;
> 94df2904 Rasmus Villemoes 2015-06-25  978       return s;
> 94df2904 Rasmus Villemoes 2015-06-25  979  }
> 94df2904 Rasmus Villemoes 2015-06-25  980  EXPORT_SYMBOL(strreplace);
> b90d6eba Daniel Micay     2017-06-06  981
> b90d6eba Daniel Micay     2017-06-06  982  void fortify_panic(const char *name)
> b90d6eba Daniel Micay     2017-06-06  983  {
> 8a94b337 Kees Cook        2017-06-26  984       pr_emerg("detected buffer overflow in %s\n", name);
> 8a94b337 Kees Cook        2017-06-26  985       BUG();
> b90d6eba Daniel Micay     2017-06-06 @986  }
> b90d6eba Daniel Micay     2017-06-06  987  EXPORT_SYMBOL(fortify_panic);

This implies that the sh arch doesn't correctly mark their BUG
implementation as not returning... I'll send a patch.

-Kees

-- 
Kees Cook
Pixel Security