| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <20170807111615.4187078-1-arnd@arndb.de>
Date: Mon, 7 Aug 2017 13:15:03 +0200
From: Arnd Bergmann <arnd@...db.de>
To: Kees Cook <keescook@...omium.org>,
Andrew Morton <akpm@...ux-foundation.org>,
Daniel Micay <danielmicay@...il.com>
Cc: Arnd Bergmann <arnd@...db.de>,
Dan Williams <dan.j.williams@...el.com>,
David Howells <dhowells@...hat.com>,
linux-kernel@...r.kernel.org
Subject: [PATCH] string.h: work around __builtin_constant_p quirk
The compile-time check in the hardened memcpy() triggered a build
error in code that should not have:
In function 'memcpy',
inlined from '__adfs_dir_put' at fs/adfs/dir_f.c:318:2,
inlined from 'adfs_f_update' at fs/adfs/dir_f.c:403:2:
include/linux/string.h:305:4: error: call to '__read_overflow2' declared with attribute error: detected read beyond size of object passed as 2nd parameter
__read_overflow2();
^~~~~~~~~~~~~~~~~~
My understanding is that in the __adfs_dir_put() function, the gcc
uses a specialization for the common 'thissize = 26', which due to
jump threading leads to a case where it has shown that 'thissize'
can be constant, but at the same time another case exists where
it may have a negative value (for sb->s_blocksize=0) that could lead
to overflowing the local 'adfs_direntry de' variable.
The bug was hidden before patch "fortify: use WARN instead of BUG
for now", which apparently dropped the compile-time checks due to
the following code being marked as '__unreachable'.
This reworks the hardened string functions to avoid some branches,
and introduces a macro for checking whether the argument is a
compile-time constant.
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
Fixes: mmotm ("fortify: use WARN instead of BUG for now")
Fixes: 6974f0c4555e ("include/linux/string.h: add the option of fortified string.h functions")
Signed-off-by: Arnd Bergmann <arnd@...db.de>
---
include/linux/string.h | 62 ++++++++++++++++++++++++++++++--------------------
1 file changed, 37 insertions(+), 25 deletions(-)
diff --git a/include/linux/string.h b/include/linux/string.h
index 25f47e07c4c6..3ba29007a942 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -203,10 +203,19 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob
void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter");
#if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE)
+
+/*
+ * a more reliable check for constant arguments, see
+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785
+ */
+#define __constant_argument(arg) \
+ __builtin_choose_expr(__builtin_constant_p(arg), (arg), 0)
+
__FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__write_overflow();
if (p_size < size)
fortify_overflow(__func__);
@@ -257,7 +266,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size)
ret = strlen(q);
if (size) {
size_t len = (ret >= size) ? size - 1 : ret;
- if (__builtin_constant_p(len) && len >= p_size)
+ size_t constlen = __constant_argument(len);
+ if (constlen >= p_size)
__write_overflow();
if (len >= p_size)
fortify_overflow(__func__);
@@ -287,7 +297,8 @@ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count)
__FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__write_overflow();
if (p_size < size)
fortify_overflow(__func__);
@@ -298,12 +309,11 @@ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
size_t q_size = __builtin_object_size(q, 0);
- if (__builtin_constant_p(size)) {
- if (p_size < size)
- __write_overflow();
- if (q_size < size)
- __read_overflow2();
- }
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
+ __write_overflow();
+ if (q_size < constsize)
+ __read_overflow2();
if (p_size < size || q_size < size)
fortify_overflow(__func__);
return __builtin_memcpy(p, q, size);
@@ -313,12 +323,11 @@ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
size_t q_size = __builtin_object_size(q, 0);
- if (__builtin_constant_p(size)) {
- if (p_size < size)
- __write_overflow();
- if (q_size < size)
- __read_overflow2();
- }
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
+ __write_overflow();
+ if (q_size < constsize)
+ __read_overflow2();
if (p_size < size || q_size < size)
fortify_overflow(__func__);
return __builtin_memmove(p, q, size);
@@ -328,7 +337,8 @@ extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan);
__FORTIFY_INLINE void *memscan(void *p, int c, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__read_overflow();
if (p_size < size)
fortify_overflow(__func__);
@@ -339,12 +349,11 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
size_t q_size = __builtin_object_size(q, 0);
- if (__builtin_constant_p(size)) {
- if (p_size < size)
- __read_overflow();
- if (q_size < size)
- __read_overflow2();
- }
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
+ __read_overflow();
+ if (q_size < constsize)
+ __read_overflow2();
if (p_size < size || q_size < size)
fortify_overflow(__func__);
return __builtin_memcmp(p, q, size);
@@ -353,7 +362,8 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size)
__FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__read_overflow();
if (p_size < size)
fortify_overflow(__func__);
@@ -364,7 +374,8 @@ void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv);
__FORTIFY_INLINE void *memchr_inv(const void *p, int c, size_t size)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__read_overflow();
if (p_size < size)
fortify_overflow(__func__);
@@ -375,7 +386,8 @@ extern void *__real_kmemdup(const void *src, size_t len, gfp_t gfp) __RENAME(kme
__FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp)
{
size_t p_size = __builtin_object_size(p, 0);
- if (__builtin_constant_p(size) && p_size < size)
+ size_t constsize = __constant_argument(size);
+ if (p_size < constsize)
__read_overflow();
if (p_size < size)
fortify_overflow(__func__);
--
2.9.0
Powered by blists - more mailing lists