lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <06a907d2-e976-ed8a-bfff-277c835d9ab2@intel.com> Date: Mon, 26 Sep 2022 18:57:53 +0300 From: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com> To: Kees Cook <keescook@...omium.org> CC: Luc Van Oostenryck <luc.vanoostenryck@...il.com>, Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <ndesaulniers@...gle.com>, Tom Rix <trix@...hat.com>, Daniel Latypov <dlatypov@...gle.com>, Vitor Massaru Iha <vitor@...saru.org>, "Gustavo A. R. Silva" <gustavoars@...nel.org>, <linux-hardening@...r.kernel.org>, <llvm@...ts.linux.dev>, <intel-gfx@...ts.freedesktop.org>, <linux-kernel@...r.kernel.org>, <dri-devel@...ts.freedesktop.org>, <mchehab@...nel.org>, <chris@...is-wilson.co.uk>, <matthew.auld@...el.com>, <thomas.hellstrom@...ux.intel.com>, <jani.nikula@...el.com>, <nirmoy.das@...el.com>, <airlied@...hat.com>, <daniel@...ll.ch>, <andi.shyti@...ux.intel.com>, <andrzej.hajda@...el.com>, <mauro.chehab@...ux.intel.com>, <linux@...musvillemoes.dk>, <linux-sparse@...r.kernel.org> Subject: Re: [PATCH v11.5] overflow: Introduce overflows_type() and __castable_to_type() On 9/26/22 3:37 AM, Kees Cook wrote: > Add overflows_type() to test if a variable or constant value would > overflow another variable or type. This can be used as a constant > expression for static_assert() (which requires a constant > expression[1][2]) when used on constant values. This must be constructed > manually, since __builtin_add_overflow() does not produce a constant > expression[3]. > > Additionally adds __castable_to_type(), similar to __same_type(), for > checking if a constant value will fit in a given type (i.e. it could > be cast to the type without overflow). > > Add unit tests for overflows_type(), __same_type(), and > __castable_to_type() to the existing KUnit "overflow" test. > > [1] https://en.cppreference.com/w/c/language/_Static_assert > [2] C11 standard (ISO/IEC 9899:2011): 6.7.10 Static assertions > [3] https://gcc.gnu.org/onlinedocs/gcc/Integer-Overflow-Builtins.html > 6.56 Built-in Functions to Perform Arithmetic with Overflow Checking > Built-in Function: bool __builtin_add_overflow (type1 a, type2 b, > type3 *res) > > Cc: Luc Van Oostenryck <luc.vanoostenryck@...il.com> > Cc: Nathan Chancellor <nathan@...nel.org> > Cc: Nick Desaulniers <ndesaulniers@...gle.com> > Cc: Tom Rix <trix@...hat.com> > Cc: Daniel Latypov <dlatypov@...gle.com> > Cc: Vitor Massaru Iha <vitor@...saru.org> > Cc: "Gustavo A. R. Silva" <gustavoars@...nel.org> > Cc: linux-hardening@...r.kernel.org > Cc: llvm@...ts.linux.dev > Co-developed-by: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com> > Signed-off-by: Gwan-gyeong Mun <gwan-gyeong.mun@...el.com> > Signed-off-by: Kees Cook <keescook@...omium.org> > --- > include/linux/compiler.h | 1 + > include/linux/overflow.h | 48 +++++ > lib/overflow_kunit.c | 393 ++++++++++++++++++++++++++++++++++++++- > 3 files changed, 441 insertions(+), 1 deletion(-) > > diff --git a/include/linux/compiler.h b/include/linux/compiler.h > index 7713d7bcdaea..c631107e93b1 100644 > --- a/include/linux/compiler.h > +++ b/include/linux/compiler.h > @@ -244,6 +244,7 @@ static inline void *offset_to_ptr(const int *off) > * bool and also pointer types. > */ > #define is_signed_type(type) (((type)(-1)) < (__force type)1) > +#define is_unsigned_type(type) (!is_signed_type(type)) > > /* > * This is needed in functions which generate the stack canary, see > diff --git a/include/linux/overflow.h b/include/linux/overflow.h > index 19dfdd74835e..c8cbeae5f4f8 100644 > --- a/include/linux/overflow.h > +++ b/include/linux/overflow.h > @@ -127,6 +127,54 @@ static inline bool __must_check __must_check_overflow(bool overflow) > (*_d >> _to_shift) != _a); \ > })) > > +#define __overflows_type_constexpr(x, T) ( \ > + is_unsigned_type(typeof(x)) ? \ > + (x) > type_max(typeof(T)) ? 1 : 0 \ > + : is_unsigned_type(typeof(T)) ? \ > + (x) < 0 || (x) > type_max(typeof(T)) ? 1 : 0 \ > + : (x) < type_min(typeof(T)) || \ > + (x) > type_max(typeof(T)) ? 1 : 0 ) > + > +#define __overflows_type(x, T) ({ \ > + typeof(T) v = 0; \ > + check_add_overflow((x), v, &v); \ > +}) > + > +/** > + * overflows_type - helper for checking the overflows between value, variables, > + * or data type > + * > + * @n: source constant value or variable to be checked > + * @T: destination variable or data type proposed to store @x > + * > + * Compares the @x expression for whether or not it can safely fit in > + * the storage of the type in @T. @x and @T can have different types. > + * If @x is a conxtant expression, this will also resolve to a constant > + * expression. > + * > + * Returns: true if overflow can occur, false otherwise. > + */ > +#define overflows_type(n, T) \ > + __builtin_choose_expr(__is_constexpr(n), \ > + __overflows_type_constexpr(n, T), \ > + __overflows_type(n, T)) > + > +/** > + * __castable_to_type - like __same_type(), but also allows for casted literals > + * > + * @n: variable or constant value > + * @T: data type or variable > + * > + * Unlike the __same_type() macro, this allows a constant value as the > + * first argument. If this value would not overflow into an assignment > + * of the second argument's type, it returns true. Otherwise, this falls > + * back to __same_type(). > + */ > +#define __castable_to_type(n, T) \ > + __builtin_choose_expr(__is_constexpr(n), \ > + !__overflows_type_constexpr(n, T), \ > + __same_type(n, T)) > + This name is fine, but I prefer the __same_typable you suggested as a comment in the previous patch better, what do you think? ( __castable_to_type(n, T); The macro name seems to handle if type casting is possible to the second argument type from the first argument variable. ) G.G.
Powered by blists - more mailing lists