linux-kernel - Re: linux-next: Tree for May 16 (security/landlock/ruleset.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202505191117.C094A90F88@keescook>
Date: Mon, 19 May 2025 11:19:53 -0700
From: Kees Cook <kees@...nel.org>
To: Mickaël Salaün <mic@...ikod.net>
Cc: Randy Dunlap <rdunlap@...radead.org>,
	Steven Rostedt <rostedt@...dmis.org>,
	Stephen Rothwell <sfr@...b.auug.org.au>,
	Linux Next Mailing List <linux-next@...r.kernel.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	linux-security-module@...r.kernel.org,
	Günther Noack <gnoack@...gle.com>
Subject: Re: linux-next: Tree for May 16 (security/landlock/ruleset.c)

On Mon, May 19, 2025 at 05:29:30PM +0200, Mickaël Salaün wrote:
> On Fri, May 16, 2025 at 07:54:14PM -0700, Randy Dunlap wrote:
> > 
> > 
> > On 5/16/25 3:24 AM, Stephen Rothwell wrote:
> > > Hi all,
> > > 
> > > Changes since 20250515:
> 
> Thanks for the report.
> 
> It is the same warning as reported here:
> https://lore.kernel.org/all/202501040747.S3LYfvYq-lkp@intel.com/
> 
> I don't know what the actual issue is though.
> 
> > 
> > on i386:
> > 
> > In file included from ../arch/x86/include/asm/string.h:3,
> >                  from ../include/linux/string.h:65,
> >                  from ../include/linux/bitmap.h:13,
> >                  from ../include/linux/cpumask.h:12,
> >                  from ../include/linux/smp.h:13,
> >                  from ../include/linux/lockdep.h:14,
> >                  from ../security/landlock/ruleset.c:16:
> > ../security/landlock/ruleset.c: In function 'create_rule':
> > ../arch/x86/include/asm/string_32.h:150:25: warning: '__builtin_memcpy' accessing 4294967295 bytes at offsets 20 and 0 overlaps 6442450943 bytes at offset -2147483648 [-Wrestrict]
> >   150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
> >       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
> > ../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
> >   137 |         memcpy(new_rule->layers, layers,
> >       |         ^~~~~~
> > 
> > 
> > Full randconfig file is attached.

The trigger appears to be CONFIG_PROFILE_ALL_BRANCHES, and GCC getting
tricked into thinking check_mul_overflow() returns true:

In file included from ../arch/x86/include/asm/string.h:3,
                 from ../include/linux/string.h:65,
                 from ../include/linux/bitmap.h:13,
                 from ../include/linux/cpumask.h:12,
                 from ../include/linux/smp.h:13,
                 from ../include/linux/lockdep.h:14,
                 from ../security/landlock/ruleset.c:16:
../security/landlock/ruleset.c: In function 'create_rule':
../arch/x86/include/asm/string_32.h:150:25: warning: '__builtin_memcpy' accessing 4294967295 bytes at offsets 0 and 0 overlaps 6442450943 bytes at offset -2147483648 [-Wrestrict]
  150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
  137 |         memcpy(new_rule->layers, layers,
      |         ^~~~~~
  'create_rule': event 1
../include/linux/compiler.h:69:46:
   68 |         (cond) ?                                        \
      |         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
   69 |                 (__if_trace.miss_hit[1]++,1) :          \
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~
      |                                              |
      |                                              (1) when the condition is evaluated to true
   70 |                 (__if_trace.miss_hit[0]++,0);           \
      |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~  
../include/linux/compiler.h:57:69: note: in expansion of macro '__trace_if_value'
   57 | #define __trace_if_var(cond) (__builtin_constant_p(cond) ? (cond) : __trace_if_value(cond))
      |                                                                     ^~~~~~~~~~~~~~~~
../include/linux/compiler.h:55:28: note: in expansion of macro '__trace_if_var'
   55 | #define if(cond, ...) if ( __trace_if_var( !!(cond , ## __VA_ARGS__) ) )
      |                            ^~~~~~~~~~~~~~
../include/linux/overflow.h:270:9: note: in expansion of macro 'if'
  270 |         if (check_mul_overflow(factor1, factor2, &bytes))
      |         ^~
  'create_rule': event 2
../arch/x86/include/asm/string_32.h:150:25:
  150 | #define memcpy(t, f, n) __builtin_memcpy(t, f, n)
      |                         ^~~~~~~~~~~~~~~~~~~~~~~~~
      |                         |
      |                         (2) out of array bounds here
../security/landlock/ruleset.c:137:9: note: in expansion of macro 'memcpy'
  137 |         memcpy(new_rule->layers, layers,
      |         ^~~~~~
make[1]: Leaving directory '/srv/code/gcc-bug'


I'll take a look at ways to make either the overflow macros or memcpy
robust against this kind of weirdness...

-- 
Kees Cook