linux-kernel - Re: linux-next: build failure after merge of the kspp tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <202201251400.9F091FC@keescook>
Date:   Tue, 25 Jan 2022 14:01:57 -0800
From:   Kees Cook <keescook@...omium.org>
To:     Steven Rostedt <rostedt@...dmis.org>
Cc:     Masami Hiramatsu <mhiramat@...nel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>
Subject: Re: linux-next: build failure after merge of the kspp tree

On Tue, Jan 25, 2022 at 04:23:26PM -0500, Steven Rostedt wrote:
> On Tue, 25 Jan 2022 12:57:24 -0800
> Kees Cook <keescook@...omium.org> wrote:
> 
> > On Tue, Jan 25, 2022 at 11:31:54PM +0900, Masami Hiramatsu wrote:
> > > On Tue, 25 Jan 2022 22:27:32 +0900
> > > Masami Hiramatsu <mhiramat@...nel.org> wrote:
> > >   
> > > > > /*
> > > > >  * struct trace_event_data_offsets_<call> {
> > > > >  *      u32                             <item1>;
> > > > >  *      u32                             <item2>;
> > > > >  *      [...]
> > > > >  * };
> > > > >  *
> > > > >  * The __dynamic_array() macro will create each u32 <item>, this is
> > > > >  * to keep the offset of each array from the beginning of the event.
> > > > >  * The size of an array is also encoded, in the higher 16 bits of
> > > > >  * <item>.
> > > > >  */
> > > > > 
> > > > > So, I think -Warray-bounds is refusing to see the destination as
> > > > > anything except a u32, but being accessed at 4 (sizeof(u32)) + 8
> > > > > (address && 0xffff) (?)  
> > > > 
> > > > Ah, I got it. Yes, that's right. __data_loc() will access the data
> > > > from the __entry, but the __rel_loc() points the same address from
> > > > the encoded field ("__rel_loc_foo" in this case) itself.
> > > > This is introduced for the user application event, which doesn't
> > > > know the actual __entry size because the __entry includes some
> > > > kernel internal defined fields.
> > > >   
> > > > > But if this is true, I would imagine there would be plenty of other
> > > > > warnings? I'm currently stumped.  
> > > > 
> > > > That is because __rel_loc is used only in the sample code in the kernel
> > > > for testing. Other use-cases comes from user-space.
> > > > Hmm, can we skip this boundary check for this example?  
> > > 
> > > If the -Warray-bounds determines the destination array size from
> > > the type of given pointer, we can just change the macro as below;
> > > 
> > > #define __get_rel_dynamic_array(field) 
> > > 			((void *)__entry +                                 \
> > > 			 offsetof(typeof(*__entry), __rel_loc_##field) +   \
> > > 			 sizeof(__entry->__rel_loc_##field) +              \
> > > 			 (__entry->__rel_loc_##field & 0xffff))
> > > 
> > > This must works same as __get_dynamic_array() macro.
> > > 
> > > Could you try this patch?
> > > 
> > > From 2982ba01367ec1f746a4f128512436e5325a7f9d Mon Sep 17 00:00:00 2001
> > > From: Masami Hiramatsu <mhiramat@...nel.org>
> > > Date: Tue, 25 Jan 2022 23:19:30 +0900
> > > Subject: [PATCH] tracing: Avoid -Warray-bounds warning for __rel_loc macro
> > > 
> > > Since -Warray-bounds checks the destination size from the
> > > type of given pointer, __assign_rel_str() macro gets warned
> > > because it passes the pointer to the 'u32' field instead of
> > > 'trace_event_raw_*' data structure.
> > > Pass the data address calculated from the 'trace_event_raw_*'
> > > instead of 'u32' __rel_loc field.
> > > 
> > > Signed-off-by: Masami Hiramatsu <mhiramat@...nel.org>
> > > Reported-by: Stephen Rothwell <sfr@...b.auug.org.au>
> > > Cc: Kees Cook <keescook@...omium.org>
> > > ---
> > >  include/trace/trace_events.h | 7 ++++---
> > >  1 file changed, 4 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/include/trace/trace_events.h b/include/trace/trace_events.h
> > > index 8c6f7c433518..65d927e059d3 100644
> > > --- a/include/trace/trace_events.h
> > > +++ b/include/trace/trace_events.h
> > > @@ -318,9 +318,10 @@ TRACE_MAKE_SYSTEM_STR();
> > >  #define __get_str(field) ((char *)__get_dynamic_array(field))
> > >  
> > >  #undef __get_rel_dynamic_array
> > > -#define __get_rel_dynamic_array(field)	\
> > > -		((void *)(&__entry->__rel_loc_##field) +	\
> > > -		 sizeof(__entry->__rel_loc_##field) +		\
> > > +#define __get_rel_dynamic_array(field)					\
> > > +		((void *)__entry + 					\
> > > +		 offsetof(typeof(*__entry), __rel_loc_##field) +	\
> > > +		 sizeof(__entry->__rel_loc_##field) +			\
> > >  		 (__entry->__rel_loc_##field & 0xffff))
> > >  
> > >  #undef __get_rel_dynamic_array_len  
> > 
> > This patch doesn't silence the warning, but now that I see the shape of
> > things more clearly, let me see if I can find the right combo.
> 
> Hmm, could the zero size array cause an issues here. That is, does this
> help?
> 
> diff --git a/include/trace/trace_events.h b/include/trace/trace_events.h
> index 65d927e059d3..3d29919045af 100644
> --- a/include/trace/trace_events.h
> +++ b/include/trace/trace_events.h
> @@ -128,7 +128,7 @@ TRACE_MAKE_SYSTEM_STR();
>  	struct trace_event_raw_##name {					\
>  		struct trace_entry	ent;				\
>  		tstruct							\
> -		char			__data[0];			\
> +		char			__data[];			\
>  	};								\
>  									\
>  	static struct trace_event_class event_class_##name;

I changed this too, just to future-proof it, and in an attempt to base
the address off of __data[] (which turned out not to be needed).

It turns out that there was still a version of the __get_rel_dyanmic_array
in perf.h that was the actual culprit.

-- 
Kees Cook