linux-kernel - Re: [PATCH] init/Kconfig: extend -Wno-array-bounds to gcc 13

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 06 Mar 2023 15:02:23 -0800
From:   Kees Cook <kees@...nel.org>
To:     Nick Desaulniers <ndesaulniers@...gle.com>,
        Tom Rix <trix@...hat.com>, Kees Cook <keescook@...omium.org>
CC:     mhiramat@...nel.org, akpm@...ux-foundation.org,
        masahiroy@...nel.org, paulmck@...nel.org, hannes@...xchg.org,
        ojeda@...nel.org, thunder.leizhen@...wei.com,
        christophe.leroy@...roup.eu, vbabka@...e.cz,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] init/Kconfig: extend -Wno-array-bounds to gcc 13

On March 6, 2023 2:20:50 PM PST, Nick Desaulniers <ndesaulniers@...gle.com> wrote:
>+ Kees
>https://lore.kernel.org/lkml/20230306220947.1982272-1-trix@redhat.com/
>
>On Mon, Mar 6, 2023 at 2:10 PM Tom Rix <trix@...hat.com> wrote:
>>
>> With gcc 13.0.1 on x86, there are several false positives like
>>
>> drivers/net/ethernet/microchip/sparx5/sparx5_psfp.c:167:31:
>>   error: array subscript 4 is above array bounds of ‘const struct sparx5_psfp_gce[4]’ [-Werror=array-bounds=]
>>   167 |                 gce = &sg->gce[i];
>>       |                        ~~~~~~~^~~
>> In file included from drivers/net/ethernet/microchip/sparx5/sparx5_psfp.c:8:
>> drivers/net/ethernet/microchip/sparx5/sparx5_main.h:506:32: note: while referencing ‘gce’
>>   506 |         struct sparx5_psfp_gce gce[SPX5_PSFP_GCE_CNT];
>>       |                                ^~~
>>
>> The code lines for the reported problem
>>         /* For each scheduling entry */
>>         for (i = 0; i < sg->num_entries; i++) {
>>                 gce = &sg->gce[i];
>>
>> i is bounded by num_entries, which is set in sparx5_tc_flower.c
>>         if (act->gate.num_entries >= SPX5_PSFP_GCE_CNT) {
>>                 NL_SET_ERR_MSG_MOD(extack, "Invalid number of gate entries");
>>                 return -EINVAL;
>>         }
>> ..
>>         sg->num_entries = act->gate.num_entries;
>>
>> So disable array-bounds as was done on gcc 11 and 12

GCC 13 isn't released yet, and we've been working to make Linux warning-free under -Wareay-bounds. (And we succeeded briefly with GCC 11.)

I'd much rather get GCC fixed. This is due to the shift sanitizer reducing the scope of num_entries (via macro args) to 0-31, which is still >4. This seems like a hinting bug in GCC: just because the variable was used in a shift doesn't mean the compiler can make any value assumptions.

-Kees



-- 
Kees Cook