Messages in this thread Patch in this message |  | | From | Arnd Bergmann <> | Subject | [PATCH] string.h: work around __builtin_constant_p quirk | Date | Mon, 7 Aug 2017 13:15:03 +0200 |
| |
The compile-time check in the hardened memcpy() triggered a build error in code that should not have:
In function 'memcpy', inlined from '__adfs_dir_put' at fs/adfs/dir_f.c:318:2, inlined from 'adfs_f_update' at fs/adfs/dir_f.c:403:2: include/linux/string.h:305:4: error: call to '__read_overflow2' declared with attribute error: detected read beyond size of object passed as 2nd parameter __read_overflow2(); ^~~~~~~~~~~~~~~~~~
My understanding is that in the __adfs_dir_put() function, the gcc uses a specialization for the common 'thissize = 26', which due to jump threading leads to a case where it has shown that 'thissize' can be constant, but at the same time another case exists where it may have a negative value (for sb->s_blocksize=0) that could lead to overflowing the local 'adfs_direntry de' variable.
The bug was hidden before patch "fortify: use WARN instead of BUG for now", which apparently dropped the compile-time checks due to the following code being marked as '__unreachable'.
This reworks the hardened string functions to avoid some branches, and introduces a macro for checking whether the argument is a compile-time constant.
Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785 Fixes: mmotm ("fortify: use WARN instead of BUG for now") Fixes: 6974f0c4555e ("include/linux/string.h: add the option of fortified string.h functions") Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- include/linux/string.h | 62 ++++++++++++++++++++++++++++++-------------------- 1 file changed, 37 insertions(+), 25 deletions(-)
diff --git a/include/linux/string.h b/include/linux/string.h index 25f47e07c4c6..3ba29007a942 100644 --- a/include/linux/string.h +++ b/include/linux/string.h @@ -203,10 +203,19 @@ void __read_overflow2(void) __compiletime_error("detected read beyond size of ob void __write_overflow(void) __compiletime_error("detected write beyond size of object passed as 1st parameter"); #if !defined(__NO_FORTIFY) && defined(__OPTIMIZE__) && defined(CONFIG_FORTIFY_SOURCE) + +/* + * a more reliable check for constant arguments, see + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=72785 + */ +#define __constant_argument(arg) \ + __builtin_choose_expr(__builtin_constant_p(arg), (arg), 0) + __FORTIFY_INLINE char *strncpy(char *p, const char *q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __write_overflow(); if (p_size < size) fortify_overflow(__func__); @@ -257,7 +266,8 @@ __FORTIFY_INLINE size_t strlcpy(char *p, const char *q, size_t size) ret = strlen(q); if (size) { size_t len = (ret >= size) ? size - 1 : ret; - if (__builtin_constant_p(len) && len >= p_size) + size_t constlen = __constant_argument(len); + if (constlen >= p_size) __write_overflow(); if (len >= p_size) fortify_overflow(__func__); @@ -287,7 +297,8 @@ __FORTIFY_INLINE char *strncat(char *p, const char *q, __kernel_size_t count) __FORTIFY_INLINE void *memset(void *p, int c, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __write_overflow(); if (p_size < size) fortify_overflow(__func__); @@ -298,12 +309,11 @@ __FORTIFY_INLINE void *memcpy(void *p, const void *q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); size_t q_size = __builtin_object_size(q, 0); - if (__builtin_constant_p(size)) { - if (p_size < size) - __write_overflow(); - if (q_size < size) - __read_overflow2(); - } + size_t constsize = __constant_argument(size); + if (p_size < constsize) + __write_overflow(); + if (q_size < constsize) + __read_overflow2(); if (p_size < size || q_size < size) fortify_overflow(__func__); return __builtin_memcpy(p, q, size); @@ -313,12 +323,11 @@ __FORTIFY_INLINE void *memmove(void *p, const void *q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); size_t q_size = __builtin_object_size(q, 0); - if (__builtin_constant_p(size)) { - if (p_size < size) - __write_overflow(); - if (q_size < size) - __read_overflow2(); - } + size_t constsize = __constant_argument(size); + if (p_size < constsize) + __write_overflow(); + if (q_size < constsize) + __read_overflow2(); if (p_size < size || q_size < size) fortify_overflow(__func__); return __builtin_memmove(p, q, size); @@ -328,7 +337,8 @@ extern void *__real_memscan(void *, int, __kernel_size_t) __RENAME(memscan); __FORTIFY_INLINE void *memscan(void *p, int c, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __read_overflow(); if (p_size < size) fortify_overflow(__func__); @@ -339,12 +349,11 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); size_t q_size = __builtin_object_size(q, 0); - if (__builtin_constant_p(size)) { - if (p_size < size) - __read_overflow(); - if (q_size < size) - __read_overflow2(); - } + size_t constsize = __constant_argument(size); + if (p_size < constsize) + __read_overflow(); + if (q_size < constsize) + __read_overflow2(); if (p_size < size || q_size < size) fortify_overflow(__func__); return __builtin_memcmp(p, q, size); @@ -353,7 +362,8 @@ __FORTIFY_INLINE int memcmp(const void *p, const void *q, __kernel_size_t size) __FORTIFY_INLINE void *memchr(const void *p, int c, __kernel_size_t size) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __read_overflow(); if (p_size < size) fortify_overflow(__func__); @@ -364,7 +374,8 @@ void *__real_memchr_inv(const void *s, int c, size_t n) __RENAME(memchr_inv); __FORTIFY_INLINE void *memchr_inv(const void *p, int c, size_t size) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __read_overflow(); if (p_size < size) fortify_overflow(__func__); @@ -375,7 +386,8 @@ extern void *__real_kmemdup(const void *src, size_t len, gfp_t gfp) __RENAME(kme __FORTIFY_INLINE void *kmemdup(const void *p, size_t size, gfp_t gfp) { size_t p_size = __builtin_object_size(p, 0); - if (__builtin_constant_p(size) && p_size < size) + size_t constsize = __constant_argument(size); + if (p_size < constsize) __read_overflow(); if (p_size < size) fortify_overflow(__func__); -- 2.9.0
|  |