linux-kernel - Re: [PATCH] coccinelle: semantic patch to check for potential struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202308261813.A26FA1A@keescook>
Date:   Sat, 26 Aug 2023 18:19:19 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Jacob Keller <jacob.e.keller@...el.com>
Cc:     Julia Lawall <Julia.Lawall@...6.fr>,
        "Gustavo A . R . Silva" <gustavoars@...nel.org>,
        cocci@...teme.lip6.fr, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH] coccinelle: semantic patch to check for potential
 struct_size calls

Hi!

I'm sorry I lost this email! I just found it while trying to clean up
my inbox.

On Mon, Feb 27, 2023 at 12:24:28PM -0800, Jacob Keller wrote:
> include/linux/overflow.h includes helper macros intended for calculating
> sizes of allocations. These macros prevent accidental overflow by
> saturating at SIZE_MAX.
> 
> In general when calculating such sizes use of the macros is preferred. Add
> a semantic patch which can detect code patterns which can be replaced by
> struct_size.
> 
> Note that I set the confidence to medium because this patch doesn't make an
> attempt to ensure that the relevant array is actually a flexible array. The
> struct_size macro does specifically require a flexible array. In many cases
> the detected code could be refactored to a flexible array, but this is not
> always possible (such as if there are multiple over-allocations).
> 
> Signed-off-by: Jacob Keller <jacob.e.keller@...el.com>
> Cc: Julia Lawall <Julia.Lawall@...6.fr>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Gustavo A. R. Silva <gustavoars@...nel.org>
> Cc: cocci@...teme.lip6.fr
> Cc: linux-kernel@...r.kernel.org
> 
>  scripts/coccinelle/misc/struct_size.cocci | 74 +++++++++++++++++++++++
>  1 file changed, 74 insertions(+)
>  create mode 100644 scripts/coccinelle/misc/struct_size.cocci

Yes! I'd really like to get something like this into the Coccinelle
scripts.

> diff --git a/scripts/coccinelle/misc/struct_size.cocci b/scripts/coccinelle/misc/struct_size.cocci
> new file mode 100644
> index 000000000000..4ede9586e3c6
> --- /dev/null
> +++ b/scripts/coccinelle/misc/struct_size.cocci
> @@ -0,0 +1,74 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +///
> +/// Check for code that could use struct_size().
> +///
> +// Confidence: Medium
> +// Author: Jacob Keller <jacob.e.keller@...el.com>
> +// Copyright: (C) 2023 Intel Corporation
> +// Options: --no-includes --include-headers
> +
> +virtual patch
> +virtual context
> +virtual org
> +virtual report
> +
> +// the overflow Kunit tests have some code which intentionally does not use
> +// the macros, so we want to ignore this code when reporting potential
> +// issues.
> +@...rflow_tests@
> +identifier f = overflow_size_helpers_test;
> +@@
> +
> +f
> +
> +//----------------------------------------------------------
> +//  For context mode
> +//----------------------------------------------------------
> +
> +@...ends on !overflow_tests && context@
> +expression E1, E2;
> +identifier m;
> +@@
> +(
> +* (sizeof(*E1) + (E2 * sizeof(*E1->m)))
> +)
> +
> +//----------------------------------------------------------
> +//  For patch mode
> +//----------------------------------------------------------
> +
> +@...ends on !overflow_tests && patch@
> +expression E1, E2;
> +identifier m;
> +@@
> +(
> +- (sizeof(*E1) + (E2 * sizeof(*E1->m)))
> ++ struct_size(E1, m, E2)
> +)

Two notes:

This can lead to false positives (like for struct mux_chip) which
doesn't use a flexible array member, which means struct_size() will
actually fail to build (it requires the 2nd arg to be an array).

This can miss cases that have more than a single struct depth (which is
uncommon but happens). I don't know how to match only "substruct.member"
from "ptr->substruct.member". (I know how to match the whole thing[1],
though.)

That isn't reason not to take this patch, though. It's a good start!

Thanks for writing this up!

-Kees

-- 
Kees Cook