linux-hardening - Re: [PATCH v2] overflow: Introduce overflows_type() and castable_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <854247e0-6276-4f3b-b4e9-b408e151a6b3@www.fastmail.com>
Date:   Tue, 27 Sep 2022 08:45:43 +0200
From:   "Arnd Bergmann" <arnd@...nel.org>
To:     "Kees Cook" <keescook@...omium.org>,
        "Nick Desaulniers" <ndesaulniers@...gle.com>
Cc:     "Gwan-gyeong Mun" <gwan-gyeong.mun@...el.com>,
        "Luc Van Oostenryck" <luc.vanoostenryck@...il.com>,
        "Nathan Chancellor" <nathan@...nel.org>,
        "Tom Rix" <trix@...hat.com>,
        "Daniel Latypov" <dlatypov@...gle.com>,
        "Vitor Massaru Iha" <vitor@...saru.org>,
        "Gustavo A. R. Silva" <gustavoars@...nel.org>,
        linux-hardening@...r.kernel.org, llvm@...ts.linux.dev,
        "Jani Nikula" <jani.nikula@...ux.intel.com>,
        "Joonas Lahtinen" <joonas.lahtinen@...ux.intel.com>,
        "Rodrigo Vivi" <rodrigo.vivi@...el.com>,
        "Tvrtko Ursulin" <tvrtko.ursulin@...ux.intel.com>,
        "David Airlie" <airlied@...ux.ie>,
        "Daniel Vetter" <daniel@...ll.ch>, linux-kernel@...r.kernel.org,
        intel-gfx@...ts.freedesktop.org, dri-devel@...ts.freedesktop.org,
        linux-sparse@...r.kernel.org
Subject: Re: [PATCH v2] overflow: Introduce overflows_type() and castable_to_type()

On Mon, Sep 26, 2022, at 11:07 PM, Kees Cook wrote:
> On Mon, Sep 26, 2022 at 01:17:18PM -0700, Nick Desaulniers wrote:
>> + Arnd
>> 
>> On Mon, Sep 26, 2022 at 12:11 PM Kees Cook <keescook@...omium.org> wrote:
>> > ---
>> > v2:
>> >  - fix comment typo
>> >  - wrap clang pragma to avoid GCC warnings
>> >  - style nit cleanups
>> >  - rename __castable_to_type() to castable_to_type()
>> >  - remove prior overflows_type() definition
>> > v1: https://lore.kernel.org/lkml/20220926003743.409911-1-keescook@chromium.org
>> > diff --git a/lib/overflow_kunit.c b/lib/overflow_kunit.c
>> > index f385ca652b74..fffc3f86181d 100644
>> > --- a/lib/overflow_kunit.c
>> > +++ b/lib/overflow_kunit.c
>> > @@ -16,6 +16,11 @@
>> >  #include <linux/types.h>
>> >  #include <linux/vmalloc.h>
>> >
>> > +/* We're expecting to do a lot of "always true" or "always false" tests. */
>> > +#ifdef CONFIG_CC_IS_CLANG
>> > +#pragma clang diagnostic ignored "-Wtautological-constant-out-of-range-compare"
>> > +#endif
>> 
>> Any chance we can reuse parts of __diag_ignore or __diag_clang from
>> include/linux/compiler_types.h or include/linux/compiler-clang.h
>> respectively?
>
> Hm, I'm not sure how those are supposed to be used. Those defines don't
> seem to be used externally?

We use them in a couple of places. When I originally introduced
them, the idea was to add more infrastructure around these
to replace the various -Wno-... flags in local makefiles with
more targetted annotations, and then have a way to control
the warning levels (W=1 W=2 E=1 etc) per directory and per file,
but I never completed the work to add the interesting bits.

>> Those are needed for pragmas within preprocessor macros, which we
>> don't have here, but I suspect they may be more concise to use here.
>
> Yeah, I was surprised when I had to wrap it in #ifdef given "clang" is
> part of the string.
>
>> 
>> > +#define TEST_SAME_TYPE(t1, t2, same)                   do {    \
>> > +       typeof(t1) __t1h = type_max(t1);                        \
>> > +       typeof(t1) __t1l = type_min(t1);                        \
>> > +       typeof(t2) __t2h = type_max(t2);                        \
>> > +       typeof(t2) __t2l = type_min(t2);                        \
>> 
>> Can we use __auto_type here rather than typeof(macro expansion)?
>
> I'd rather it stay explicit -- otherwise we start to wander into "oops,
> we got lucky" territory for what should be a really distinct test case.

The idea  of __auto_type is to avoid the more deeply nested macros.
If the preprocessed file turns into an absolute mess, adding a temporary
variable may help. Not sure if that applies here.

     Arnd