lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20220902204351.2521805-1-keescook@chromium.org> Date: Fri, 2 Sep 2022 13:43:48 -0700 From: Kees Cook <keescook@...omium.org> To: Nick Desaulniers <ndesaulniers@...gle.com> Cc: Kees Cook <keescook@...omium.org>, Nathan Chancellor <nathan@...nel.org>, Tom Rix <trix@...hat.com>, Andrew Morton <akpm@...ux-foundation.org>, Vlastimil Babka <vbabka@...e.cz>, "Steven Rostedt (Google)" <rostedt@...dmis.org>, David Gow <davidgow@...gle.com>, Yury Norov <yury.norov@...il.com>, Masami Hiramatsu <mhiramat@...nel.org>, Sander Vanheule <sander@...nheule.net>, Peter Zijlstra <peterz@...radead.org>, Josh Poimboeuf <jpoimboe@...nel.org>, Dan Williams <dan.j.williams@...el.com>, Isabella Basso <isabbasso@...eup.net>, Eric Dumazet <edumazet@...gle.com>, Rasmus Villemoes <linux@...musvillemoes.dk>, Eric Biggers <ebiggers@...gle.com>, Hannes Reinecke <hare@...e.de>, linux-hardening@...r.kernel.org, linux-kernel@...r.kernel.org, llvm@...ts.linux.dev Subject: [PATCH v2 0/3] Fix FORTIFY=y UBSAN_LOCAL_BOUNDS=y With CONFIG_FORTIFY=y and CONFIG_UBSAN_LOCAL_BOUNDS=y enabled, we observe a runtime panic while running Android's Compatibility Test Suite's (CTS) android.hardware.input.cts.tests. This is stemming from a strlen() call in hidinput_allocate(). __builtin_object_size(str, 0 or 1) has interesting behavior for C strings when str is runtime dependent, and all possible values are known at compile time; it evaluates to the maximum of those sizes. This causes UBSAN_LOCAL_BOUNDS to insert faults for the smaller values, which we trip at runtime. Patch 1 is the actual fix, using a 0-index __builtin_constant_p() check to short-circuit the runtime check. Patch 2 is a KUnit test to validate this behavior going forward. Patch 3 is is a cosmetic cleanup to use SIZE_MAX instead of (size_t)-1 -Kees v2: - different solution - add KUnit test - expand scope of cosmetic cleanup v1: https://lore.kernel.org/lkml/20220830205309.312864-1-ndesaulniers@google.com Kees Cook (3): fortify: Fix __compiletime_strlen() under UBSAN_BOUNDS_LOCAL fortify: Add KUnit test for FORTIFY_SOURCE internals fortify: Use SIZE_MAX instead of (size_t)-1 MAINTAINERS | 1 + include/linux/fortify-string.h | 29 ++++++------- lib/Kconfig.debug | 9 ++++ lib/Makefile | 1 + lib/fortify_kunit.c | 77 ++++++++++++++++++++++++++++++++++ 5 files changed, 103 insertions(+), 14 deletions(-) create mode 100644 lib/fortify_kunit.c -- 2.34.1
Powered by blists - more mailing lists