linux-kernel - Re: [PATCH 3/3] module: Add compile-time check for embedded NUL characters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTn0WdVv-S_EpQmS@agluck-desk3>
Date: Wed, 10 Dec 2025 14:29:45 -0800
From: "Luck, Tony" <tony.luck@...el.com>
To: Sami Tolvanen <samitolvanen@...gle.com>, Dan Carpenter
	<dan.carpenter@...aro.org>, Chris Li <sparse@...isli.org>
CC: Daniel Gomez <da.gomez@...nel.org>, Eric Biggers <ebiggers@...nel.org>,
	Kees Cook <kees@...nel.org>, Luis Chamberlain <mcgrof@...nel.org>, "Rusty
 Russell" <rusty@...tcorp.com.au>, Petr Pavlu <petr.pavlu@...e.com>,
	"linux-modules@...r.kernel.org" <linux-modules@...r.kernel.org>, "Malcolm
 Priestley" <tvboxspy@...il.com>, Mauro Carvalho Chehab <mchehab@...nel.org>,
	Hans Verkuil <hverkuil@...nel.org>, Uwe Kleine-König
	<u.kleine-koenig@...gutronix.de>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "linux-media@...r.kernel.org"
	<linux-media@...r.kernel.org>, "linux-hardening@...r.kernel.org"
	<linux-hardening@...r.kernel.org>
Subject: Re: [PATCH 3/3] module: Add compile-time check for embedded NUL
 characters

[Added Dan Carpenter and Chris Li]

Dan and Chris,

You're in the git log for sparse wrting/commiting fixes. Can you take
a look at this?  Sami's fix works for me.

-Tony

On Wed, Dec 10, 2025 at 01:00:20AM +0000, Sami Tolvanen wrote:
> On Tue, Dec 09, 2025 at 10:29:06AM -0800, Luck, Tony wrote:
> > On Tue, Dec 09, 2025 at 08:45:14AM -0800, Luck, Tony wrote:
> > > On Tue, Dec 09, 2025 at 04:20:06PM +0000, Luck, Tony wrote:
> > > > >> Likewise, I just got the following kernel test robot report sent to me,
> > > > >> where it's warning about MODULE_LICENSE("GPL"):
> > > > >> https://lore.kernel.org/all/202512090359.7BkUaiC9-lkp@intel.com/
> > > > >
> > > > > Can you both confirm which version of sparse are you using?
> > > > >
> > > > > My understanding was that this patch fixed that problem:
> > > > > >https://lore.kernel.org/linux-sparse/CACePvbVG2KrGQq4cNKV=wbO5h=jp3M0RO1SdfX8kV4OukjPG8A@mail.gmail.com/T/#mf838b3e2e3245d88c30a801ea7473d5a5c0eb121
> > > > 
> > > > > The patch is already merged into the sparse tree, and I was not able to
> > > > > reproduce the issue.
> > > > 
> > > > I pulled the latest sparse source and re-checked before reporting. Top commit I have is the one you mention:
> > > > 
> > > > fbdde3127b83 ("builtin: implement __builtin_strlen() for constants")
> > > > 
> > > > I'm building latest Linus tree from the current merge window (well latest as-of yesterday):
> > > > 
> > > > c2f2b01b74be ("Merge tag 'i3c/for-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux")
> > > 
> > > I added a debug trace to the new expand_strlen() function added to
> > > sparse. It is being called and doing the right thing. My trace says:
> > > 
> > > 	len(GPL) = 3
> > 
> > Simple test case:
> > 
> > $ cat -n s.c
> >      1
> >      2  _Static_assert(sizeof("GPL") - 1 == 3, "sizeof");
> >      3
> >      4  _Static_assert(__builtin_strlen("GPL") == 3, "strlen");
> > 
> > $ sparse s.c
> > s.c:4:40: error: bad integer constant expression
> > s.c:4:40: error: static assertion failed: "strlen"
> > 
> > So the "sizeof" bit is OK. But the __builtin_strlen() isn't.
> 
> This looks like a bug in Sparse. The CEF_ICE flag isn't propagated to
> the comparison expression, which it presumably should be when both
> sides are integer constant expressions.
> 
> I'm not really familiar enough with Sparse to know whether this is the
> correct place to handle this case, but this quick hack fixes the issue
> for me:
> 
> diff --git a/expand.c b/expand.c
> index f14e7181..71221d35 100644
> --- a/expand.c
> +++ b/expand.c
> @@ -535,6 +535,8 @@ static int expand_compare(struct expression *expr)
>  			expr->taint = 0;
>  			return 0;
>  		}
> +		if (left->flags & CEF_ICE && right->flags & CEF_ICE)
> +			expr->flags |= CEF_SET_ICE;
>  		if (simplify_cmp_binop(expr, left->ctype))
>  			return 0;
>  		if (simplify_float_cmp(expr, left->ctype))
> 
> Sami