[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20240805214340.work.339-kees@kernel.org>
Date: Mon, 5 Aug 2024 14:43:44 -0700
From: Kees Cook <kees@...nel.org>
To: Andy Shevchenko <andy@...nel.org>
Cc: Kees Cook <kees@...nel.org>,
Justin Stitt <justinstitt@...gle.com>,
Luc Van Oostenryck <luc.vanoostenryck@...il.com>,
Nick Desaulniers <ndesaulniers@...gle.com>,
Miguel Ojeda <ojeda@...nel.org>,
Marco Elver <elver@...gle.com>,
Nathan Chancellor <nathan@...nel.org>,
Hao Luo <haoluo@...gle.com>,
Przemek Kitszel <przemyslaw.kitszel@...el.com>,
linux-sparse@...r.kernel.org,
linux-hardening@...r.kernel.org,
Bill Wendling <morbo@...gle.com>,
Mark Rutland <mark.rutland@....com>,
Jakub Kicinski <kuba@...nel.org>,
Alexander Lobakin <aleksander.lobakin@...el.com>,
Tony Ambardar <tony.ambardar@...il.com>,
Petr Pavlu <petr.pavlu@...e.com>,
linux-kernel@...r.kernel.org,
llvm@...ts.linux.dev
Subject: [PATCH] string: Check for "nonstring" attribute on strscpy() arguments
GCC already checks for arguments that are marked with the "nonstring"[1]
attribute when used on standard C String API functions (e.g. strcpy). Gain
this compile-time checking also for the kernel's primary string copying
function, strscpy().
Note that Clang has neither "nonstring" nor __builtin_has_attribute().
Link: https://gcc.gnu.org/onlinedocs/gcc/Common-Variable-Attributes.html#index-nonstring-variable-attribute [1]
Signed-off-by: Kees Cook <kees@...nel.org>
---
Cc: Andy Shevchenko <andy@...nel.org>
Cc: Justin Stitt <justinstitt@...gle.com>
Cc: Luc Van Oostenryck <luc.vanoostenryck@...il.com>
Cc: Nick Desaulniers <ndesaulniers@...gle.com>
Cc: Miguel Ojeda <ojeda@...nel.org>
Cc: Marco Elver <elver@...gle.com>
Cc: Nathan Chancellor <nathan@...nel.org>
Cc: Hao Luo <haoluo@...gle.com>
Cc: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Cc: linux-sparse@...r.kernel.org
Cc: linux-hardening@...r.kernel.org
---
include/linux/compiler.h | 3 +++
include/linux/compiler_types.h | 7 +++++++
include/linux/string.h | 12 ++++++++----
3 files changed, 18 insertions(+), 4 deletions(-)
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 2df665fa2964..ec55bcce4146 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -242,6 +242,9 @@ static inline void *offset_to_ptr(const int *off)
/* &a[0] degrades to a pointer: a different type from an array */
#define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0]))
+/* Require C Strings (i.e. NUL-terminated) lack the "nonstring" attribute. */
+#define __must_be_cstr(p) BUILD_BUG_ON_ZERO(__annotated(p, nonstring))
+
/*
* This returns a constant expression while determining if an argument is
* a constant expression, most importantly without evaluating the argument.
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index f14c275950b5..1a957ea2f4fe 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -421,6 +421,13 @@ struct ftrace_likely_data {
#define __member_size(p) __builtin_object_size(p, 1)
#endif
+/* Determine if an attribute has been applied to a variable. */
+#if __has_builtin(__builtin_has_attribute)
+#define __annotated(var, attr) __builtin_has_attribute(var, attr)
+#else
+#define __annotated(var, attr) (false)
+#endif
+
/*
* Some versions of gcc do not mark 'asm goto' volatile:
*
diff --git a/include/linux/string.h b/include/linux/string.h
index 9edace076ddb..95b3fc308f4f 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -76,12 +76,16 @@ ssize_t sized_strscpy(char *, const char *, size_t);
* known size.
*/
#define __strscpy0(dst, src, ...) \
- sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst))
-#define __strscpy1(dst, src, size) sized_strscpy(dst, src, size)
+ sized_strscpy(dst, src, sizeof(dst) + __must_be_array(dst) + \
+ __must_be_cstr(dst) + __must_be_cstr(src))
+#define __strscpy1(dst, src, size) \
+ sized_strscpy(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))
#define __strscpy_pad0(dst, src, ...) \
- sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst))
-#define __strscpy_pad1(dst, src, size) sized_strscpy_pad(dst, src, size)
+ sized_strscpy_pad(dst, src, sizeof(dst) + __must_be_array(dst) + \
+ __must_be_cstr(dst) + __must_be_cstr(src))
+#define __strscpy_pad1(dst, src, size) \
+ sized_strscpy_pad(dst, src, size + __must_be_cstr(dst) + __must_be_cstr(src))
/**
* strscpy - Copy a C-string into a sized buffer
--
2.34.1
Powered by blists - more mailing lists