linux-kernel - [INFO] ratio of const vs dynamic usercopy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160920045839.GA139098@beast>
Date:   Mon, 19 Sep 2016 21:58:39 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Alexander Viro <viro@...iv.linux.org.uk>
Cc:     Linus Torvalds <torvalds@...ux-foundation.org>,
        Josh Poimboeuf <jpoimboe@...hat.com>,
        linux-kernel@...r.kernel.org
Subject: [INFO] ratio of const vs dynamic usercopy

Hi,

Al had asked me a couple weeks back what the ratio of const vs dynamic
usercopying was. With Josh's cleanup and my fix-up to only call the
hardened usercopy when non-const, I can actually gather these statistics
on a build. It's a bit of a hack (see attached patch that should not go
into the tree), but with my not-very-defconfig, it's rougly 2 to 1 const
vs dynamic.  However, this doesn't take into account the frequency at
_runtime_, which maybe could be discovered via perf comparing copy*user()
calls to __check_object_size() calls, but I didn't try that. Does someone
have perf setup to check this?

$ grep 'warning: call to' build.stderr | wc -l
1505
$ grep 'warning: call to' build.stderr | grep 'const usercopy' | wc -l
998
$ grep 'warning: call to' build.stderr | grep 'dynamic usercopy' | wc -l
507

Signed-off-by: Kees Cook <keescook@...omium.org>
---
 include/linux/thread_info.h | 8 +++++++-
 mm/usercopy.c               | 4 ++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
index 2b5b10eed74f..4cae922797e5 100644
--- a/include/linux/thread_info.h
+++ b/include/linux/thread_info.h
@@ -115,14 +115,20 @@ static inline int arch_within_stack_frames(const void * const stack,
 #endif
 
 #ifdef CONFIG_HARDENED_USERCOPY
-extern void __check_object_size(const void *ptr, unsigned long n,
+extern void __compiletime_warning("dynamic usercopy")
+__check_object_size(const void *ptr, unsigned long n,
 					bool to_user);
 
+extern void __compiletime_warning("builtin-const usercopy")
+__skip_check_object_size(void);
+
 static __always_inline void check_object_size(const void *ptr, unsigned long n,
 					      bool to_user)
 {
 	if (!__builtin_constant_p(n))
 		__check_object_size(ptr, n, to_user);
+	else
+		__skip_check_object_size();
 }
 #else
 static inline void check_object_size(const void *ptr, unsigned long n,
diff --git a/mm/usercopy.c b/mm/usercopy.c
index 089328f2b920..9969a06f5e25 100644
--- a/mm/usercopy.c
+++ b/mm/usercopy.c
@@ -275,3 +275,7 @@ report:
 	report_usercopy(ptr, n, to_user, err);
 }
 EXPORT_SYMBOL(__check_object_size);
+
+void __skip_check_object_size(void)
+{ }
+EXPORT_SYMBOL(__skip_check_object_size);
-- 
2.7.4


-- 
Kees Cook
Nexus Security