Files
linux/include/linux
Kees Cook 6f7630b1b5 fortify: Capture __bos() results in const temp vars
In two recent run-time memcpy() bound checking bug reports (NFS[1] and
JFS[2]), the _detection_ was working correctly (in the sense that the
requested copy size was larger than the destination field size), but
the _warning text_ was showing the destination field size as SIZE_MAX
("unknown size"). This should be impossible, since the detection function
will explicitly give up if the destination field size is unknown. For
example, the JFS warning was:

  memcpy: detected field-spanning write (size 132) of single field "ip->i_link" at fs/jfs/namei.c:950 (size 18446744073709551615)

Other cases of this warning (e.g.[3]) have reported correctly,
and the reproducer only happens under GCC (at least 10.2 and 12.1),
so this currently appears to be a GCC bug. Explicitly capturing the
__builtin_object_size() results in const temporary variables fixes the
report. For example, the JFS reproducer now correctly reports the field
size (128):

  memcpy: detected field-spanning write (size 132) of single field "ip->i_link" at fs/jfs/namei.c:950 (size 128)

Examination of the .text delta (which is otherwise identical), shows
the literal value used in the report changing:

-     mov    $0xffffffffffffffff,%rcx
+     mov    $0x80,%ecx

[1] https://lore.kernel.org/lkml/Y0zEzZwhOxTDcBTB@codemonkey.org.uk/
[2] https://syzkaller.appspot.com/bug?id=23d613df5259b977dac1696bec77f61a85890e3d
[3] https://lore.kernel.org/all/202210110948.26b43120-yujie.liu@intel.com/

Cc: "Dr. David Alan Gilbert" <linux@treblig.org>
Cc: llvm@lists.linux.dev
Cc: linux-hardening@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
2022-10-28 16:07:01 -07:00
..
2022-09-21 11:18:28 +09:00
2022-09-26 12:19:12 -07:00
2022-09-26 19:46:29 -07:00
2022-09-26 10:13:13 -07:00
2022-09-26 10:13:13 -07:00
2022-09-15 09:32:06 -07:00
2022-09-26 10:13:14 -07:00
2022-08-31 14:57:28 +01:00
2022-10-03 14:02:45 -07:00
2022-08-16 12:46:26 +02:00
2022-09-01 18:04:43 +02:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2022-09-01 18:08:44 +02:00
2022-10-03 14:03:19 -07:00
2022-09-26 12:37:21 -04:00
2022-09-26 19:46:18 -07:00
2022-10-03 14:03:19 -07:00
2022-09-26 10:13:13 -07:00
2022-09-01 17:39:49 -04:00
2022-08-22 14:26:30 +01:00
2022-08-09 14:11:34 -04:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2022-09-26 19:46:09 -07:00
2022-10-04 20:52:38 +02:00
2022-10-11 17:42:58 -06:00
2022-09-19 06:17:05 -07:00
2022-10-11 17:42:58 -06:00
2022-09-07 12:42:25 +01:00
2022-09-29 15:20:29 +02:00
2022-09-22 16:12:34 +02:00
2022-09-22 16:12:34 +02:00
2022-08-31 13:37:32 +02:00
2022-09-01 11:42:12 +01:00
2022-09-16 10:56:08 +01:00
2022-08-28 16:52:28 +01:00
2022-10-07 09:32:40 -04:00
2022-10-07 08:10:52 -06:00
2022-09-26 19:46:18 -07:00
2022-09-26 19:46:18 -07:00
2022-09-28 10:00:16 +02:00