Gain coverage for pointer wrap-around checking. Adds support for
-fsanitize=pointer-overflow, and introduces the __pointer_wrap function
attribute to match the signed and unsigned attributes. Also like the
others, it is currently disabled under CONFIG_COMPILE_TEST.
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: Masahiro Yamada <masahi...@kernel.org>
Cc: Nathan Chancellor <nat...@kernel.org>
Cc: Nicolas Schier <nico...@fjasle.eu>
Cc: linux-kbu...@vger.kernel.org
Signed-off-by: Kees Cook <keesc...@chromium.org>
---
include/linux/compiler_types.h | 7 ++++++-
lib/Kconfig.ubsan | 8 ++++++++
lib/test_ubsan.c | 33 +++++++++++++++++++++++++++++++++
lib/ubsan.c | 21 +++++++++++++++++++++
lib/ubsan.h | 1 +
scripts/Makefile.ubsan | 1 +
6 files changed, 70 insertions(+), 1 deletion(-)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index e585614f3152..e65ce55046fd 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -293,12 +293,17 @@ struct ftrace_likely_data {
#else
# define __unsigned_wrap
#endif
+#ifdef CONFIG_UBSAN_POINTER_WRAP
+# define __pointer_wrap __attribute__((no_sanitize("pointer-overflow")))
+#else
+# define __pointer_wrap
+#endif
/* Section for code which can't be instrumented at all */
#define __noinstr_section(section) \
noinline notrace __attribute((__section__(section))) \
__no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \
- __no_sanitize_memory __signed_wrap __unsigned_wrap
+ __no_sanitize_memory __signed_wrap __unsigned_wrap __pointer_wrap
#define noinstr __noinstr_section(".noinstr.text")
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index a7003e5bd2a1..04222a6d7fd9 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -135,6 +135,14 @@ config UBSAN_UNSIGNED_WRAP
for wrap-around of any arithmetic operations with unsigned integers.
This
currently causes x86 to fail to boot.
+config UBSAN_POINTER_WRAP
+ bool "Perform checking for pointer arithmetic wrap-around"
+ depends on !COMPILE_TEST
+ depends on $(cc-option,-fsanitize=pointer-overflow)
+ help
+ This option enables -fsanitize=pointer-overflow which checks
+ for wrap-around of any arithmetic operations with pointers.
+
config UBSAN_BOOL
bool "Perform checking for non-boolean values used as boolean"
default UBSAN
diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c
index 84d8092d6c32..1cc049b3ef34 100644
--- a/lib/test_ubsan.c
+++ b/lib/test_ubsan.c
@@ -56,6 +56,36 @@ static void test_ubsan_negate_overflow(void)
val = -val;
}
+static void test_ubsan_pointer_overflow_add(void)
+{
+ volatile void *top = (void *)ULONG_MAX;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ top += 2;
+}
+
+static void test_ubsan_pointer_overflow_sub(void)
+{
+ volatile void *bottom = (void *)1;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ bottom -= 3;
+}
+
+struct ptr_wrap {
+ int a;
+ int b;
+};
+
+static void test_ubsan_pointer_overflow_mul(void)
+{
+ volatile struct ptr_wrap *half = (void *)(ULONG_MAX - 128);
+ volatile int bump = 128;
+
+ UBSAN_TEST(CONFIG_UBSAN_POINTER_WRAP);
+ half += bump;
+}
+
static void test_ubsan_divrem_overflow(void)
{
volatile int val = 16;
@@ -139,6 +169,9 @@ static const test_ubsan_fp test_ubsan_array[] = {
test_ubsan_sub_overflow,
test_ubsan_mul_overflow,
test_ubsan_negate_overflow,
+ test_ubsan_pointer_overflow_add,
+ test_ubsan_pointer_overflow_sub,
+ test_ubsan_pointer_overflow_mul,
test_ubsan_shift_out_of_bounds,
test_ubsan_out_of_bounds,
test_ubsan_load_invalid_value,
diff --git a/lib/ubsan.c b/lib/ubsan.c
index 5fc107f61934..d49580ff6aea 100644
--- a/lib/ubsan.c
+++ b/lib/ubsan.c
@@ -289,6 +289,27 @@ void __ubsan_handle_negate_overflow(void *_data, void
*old_val)
}
EXPORT_SYMBOL(__ubsan_handle_negate_overflow);
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs)
+{
+ struct overflow_data *data = _data;
+ unsigned long before = (unsigned long)lhs;
+ unsigned long after = (unsigned long)rhs;
+
+ if (suppress_report(&data->location))
+ return;
+
+ ubsan_prologue(&data->location, "pointer-overflow");
+
+ if (after == 0)
+ pr_err("overflow wrapped to NULL\n");
+ else if (after < before)
+ pr_err("overflow wrap-around\n");
+ else
+ pr_err("underflow wrap-around\n");
+
+ ubsan_epilogue();
+}
+EXPORT_SYMBOL(__ubsan_handle_pointer_overflow);
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs)
{
diff --git a/lib/ubsan.h b/lib/ubsan.h
index 0abbbac8700d..5dd27923b78b 100644
--- a/lib/ubsan.h
+++ b/lib/ubsan.h
@@ -128,6 +128,7 @@ void __ubsan_handle_add_overflow(void *data, void *lhs,
void *rhs);
void __ubsan_handle_sub_overflow(void *data, void *lhs, void *rhs);
void __ubsan_handle_mul_overflow(void *data, void *lhs, void *rhs);
void __ubsan_handle_negate_overflow(void *_data, void *old_val);
+void __ubsan_handle_pointer_overflow(void *_data, void *lhs, void *rhs);
void __ubsan_handle_divrem_overflow(void *_data, void *lhs, void *rhs);
void __ubsan_handle_type_mismatch(struct type_mismatch_data *data, void *ptr);
void __ubsan_handle_type_mismatch_v1(void *_data, void *ptr);
diff --git a/scripts/Makefile.ubsan b/scripts/Makefile.ubsan
index 7b2f3d554c59..df4ccf063f67 100644
--- a/scripts/Makefile.ubsan
+++ b/scripts/Makefile.ubsan
@@ -10,6 +10,7 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) +=
-fsanitize=integer-divide-by-zero
ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable
ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) +=
-fsanitize=signed-integer-overflow
ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) +=
-fsanitize=unsigned-integer-overflow
+ubsan-cflags-$(CONFIG_UBSAN_POINTER_WRAP) += -fsanitize=pointer-overflow
ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool
ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum
ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call
cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error)
--
2.34.1
