| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 26 Sep 2022 18:57:53 +0300
From: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com>
To: Kees Cook <keescook@...omium.org>
CC: Luc Van Oostenryck <luc.vanoostenryck@...il.com>,
Nathan Chancellor <nathan@...nel.org>,
Nick Desaulniers <ndesaulniers@...gle.com>,
Tom Rix <trix@...hat.com>,
Daniel Latypov <dlatypov@...gle.com>,
Vitor Massaru Iha <vitor@...saru.org>,
"Gustavo A. R. Silva" <gustavoars@...nel.org>,
<linux-hardening@...r.kernel.org>, <llvm@...ts.linux.dev>,
<intel-gfx@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>,
<dri-devel@...ts.freedesktop.org>, <mchehab@...nel.org>,
<chris@...is-wilson.co.uk>, <matthew.auld@...el.com>,
<thomas.hellstrom@...ux.intel.com>, <jani.nikula@...el.com>,
<nirmoy.das@...el.com>, <airlied@...hat.com>, <daniel@...ll.ch>,
<andi.shyti@...ux.intel.com>, <andrzej.hajda@...el.com>,
<mauro.chehab@...ux.intel.com>, <linux@...musvillemoes.dk>,
<linux-sparse@...r.kernel.org>
Subject: Re: [PATCH v11.5] overflow: Introduce overflows_type() and
__castable_to_type()
On 9/26/22 3:37 AM, Kees Cook wrote:
> Add overflows_type() to test if a variable or constant value would
> overflow another variable or type. This can be used as a constant
> expression for static_assert() (which requires a constant
> expression[1][2]) when used on constant values. This must be constructed
> manually, since __builtin_add_overflow() does not produce a constant
> expression[3].
>
> Additionally adds __castable_to_type(), similar to __same_type(), for
> checking if a constant value will fit in a given type (i.e. it could
> be cast to the type without overflow).
>
> Add unit tests for overflows_type(), __same_type(), and
> __castable_to_type() to the existing KUnit "overflow" test.
>
> [1] https://en.cppreference.com/w/c/language/_Static_assert
> [2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions
> [3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html
> 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking
> Built-in Function: bool __builtin_add_overflow (type1 a, type2 b,
> type3 *res)
>
> Cc: Luc Van Oostenryck <luc.vanoostenryck@...il.com>
> Cc: Nathan Chancellor <nathan@...nel.org>
> Cc: Nick Desaulniers <ndesaulniers@...gle.com>
> Cc: Tom Rix <trix@...hat.com>
> Cc: Daniel Latypov <dlatypov@...gle.com>
> Cc: Vitor Massaru Iha <vitor@...saru.org>
> Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org>
> Cc: linux-hardening@...r.kernel.org
> Cc: llvm@...ts.linux.dev
> Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com>
> Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
> include/linux/compiler.h | 1 +
> include/linux/overflow.h | 48 +++++
> lib/overflow_kunit.c | 393 ++++++++++++++++++++++++++++++++++++++-
> 3 files changed, 441 insertions(+), 1 deletion(-)
>
> diff --git a/include/linux/compiler.h b/include/linux/compiler.h
> index 7713d7bcdaea..c631107e93b1 100644
> --- a/include/linux/compiler.h
> +++ b/include/linux/compiler.h
> @@ -244,6 +244,7 @@ static inline void *offset_to_ptr(const int *off)
> * bool and also pointer types.
> */
> #define is_signed_type(type) (((type)(-1)) < (__force type)1)
> +#define is_unsigned_type(type) (!is_signed_type(type))
>
> /*
> * This is needed in functions which generate the stack canary, see
> diff --git a/include/linux/overflow.h b/include/linux/overflow.h
> index 19dfdd74835e..c8cbeae5f4f8 100644
> --- a/include/linux/overflow.h
> +++ b/include/linux/overflow.h
> @@ -127,6 +127,54 @@ static inline bool __must_check __must_check_overflow(bool overflow)
> (*_d >> _to_shift) != _a); \
> }))
>
> +#define __overflows_type_constexpr(x, T) ( \
> + is_unsigned_type(typeof(x)) ? \
> + (x) > type_max(typeof(T)) ? 1 : 0 \
> + : is_unsigned_type(typeof(T)) ? \
> + (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \
> + : (x) < type_min(typeof(T)) || \
> + (x) > type_max(typeof(T)) ? 1 : 0 )
> +
> +#define __overflows_type(x, T) ({ \
> + typeof(T) v = 0; \
> + check_add_overflow((x), v, &v); \
> +})
> +
> +/**
> + * overflows_type - helper for checking the overflows between value, variables,
> + * or data type
> + *
> + * @n: source constant value or variable to be checked
> + * @T: destination variable or data type proposed to store @x
> + *
> + * Compares the @x expression for whether or not it can safely fit in
> + * the storage of the type in @T. @x and @T can have different types.
> + * If @x is a conxtant expression, this will also resolve to a constant
> + * expression.
> + *
> + * Returns: true if overflow can occur, false otherwise.
> + */
> +#define overflows_type(n, T) \
> + __builtin_choose_expr(__is_constexpr(n), \
> + __overflows_type_constexpr(n, T), \
> + __overflows_type(n, T))
> +
> +/**
> + * __castable_to_type - like __same_type(), but also allows for casted literals
> + *
> + * @n: variable or constant value
> + * @T: data type or variable
> + *
> + * Unlike the __same_type() macro, this allows a constant value as the
> + * first argument. If this value would not overflow into an assignment
> + * of the second argument's type, it returns true. Otherwise, this falls
> + * back to __same_type().
> + */
> +#define __castable_to_type(n, T) \
> + __builtin_choose_expr(__is_constexpr(n), \
> + !__overflows_type_constexpr(n, T), \
> + __same_type(n, T))
> +
This name is fine, but I prefer the __same_typable you suggested as a
comment in the previous patch better, what do you think?
( __castable_to_type(n, T); The macro name seems to handle if type
casting is possible to the second argument type from the first argument
variable. )
G.G.
Powered by blists - more mailing lists