randstruct: fix a bug in is_pure_ops_struct()
Subsystems (2)
PATCH 1/1 randstruct: fix a bug in is_pure_ops_struct()
Before this, there were false negatives in the case where a struct contains other structs which contain only function pointers because of unreachable code in is_pure_ops_struct().
--- scripts/gcc-plugins/randomize_layout_plugin.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)
scripts/gcc-plugins/randomize_layout_plugin.c +5 -6
@@ -443,13 +443,12 @@ static int is_pure_ops_struct(const_tree node)if (node = fieldtype)continue ; -if (!is_fptr (fieldtype)) -return 0 ; - -if (code !=RECORD_TYPE && code !=UNION_TYPE ) -continue ; +if (code =RECORD_TYPE || code =UNION_TYPE ) { +if (!is_pure_ops_struct (fieldtype)) +return 0 ; + } -if (!is_pure_ops_struct (fieldtype)) +if (!is_fptr (fieldtype))return 0 ; }
Signature · 1 line
2.17.1
Kees Cook
AppliedQuoted 3 lines · Joonwon Kang
Before this, there were false negatives in the case where a struct contains other structs which contain only function pointers because of unreachable code in
is_pure_ops_struct().
Ah, very true. Something like:
struct internal {
void (*callback)(void);
};struct wrapper {
struct internal foo;
void (*other_callback)(void);
};would have not been detected as is_pure_ops_struct()?
How did you notice this? (Are there cases of this in the kernel?)
Quoted 1 line
Signed-off-by Joonwon Kang <[email protected]>
Applied; thanks!
-Kees
Quoted 30 lines
--- scripts/gcc-plugins/randomize_layout_plugin.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)scripts/gcc-plugins/randomize_layout_plugin.c +5
-6@@ -443,13 +443,12 @@ static int is_pure_ops_struct(const_tree node)if (node = fieldtype)continue ; -if (!is_fptr (fieldtype)) -return 0 ; - -if (code !=RECORD_TYPE && code !=UNION_TYPE ) -continue ; +if (code =RECORD_TYPE || code =UNION_TYPE ) { +if (!is_pure_ops_struct (fieldtype)) +return 0 ; + } -if (!is_pure_ops_struct (fieldtype)) +if (!is_fptr (fieldtype))return 0 ; }Signature · 1 line
2.17.1
Signature · 1 line
Kees Cook
Quoted 11 lines · Kees Cook
Quoted 3 lines · Joonwon Kang
Before this, there were false negatives in the case where a struct contains other structs which contain only function pointers because of unreachable code in
is_pure_ops_struct().Ah, very true. Something like:
struct internal { void (*callback)(void); };
Quoted 8 lines
struct wrapper { struct internal foo; void (*other_callback)(void); };would have not been detected as
is_pure_ops_struct()?How did you notice this? (Are there cases of this in the kernel?)
When I compiled kernel with allyesconfig, there seemed to be no such cases, but I found the bug just by code review and test.
However, I would like to slightly modify this patch and add one more patch. I will send the patch set soon.
Quoted 40 lines
Quoted 2 lines
Signed-off-by Joonwon Kang <[email protected]>Applied; thanks!
-Kees
Quoted 30 lines
--- scripts/gcc-plugins/randomize_layout_plugin.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-)scripts/gcc-plugins/randomize_layout_plugin.c +5
-6@@ -443,13 +443,12 @@ static int is_pure_ops_struct(const_tree node)if (node = fieldtype)continue ; -if (!is_fptr (fieldtype)) -return 0 ; - -if (code !=RECORD_TYPE && code !=UNION_TYPE ) -continue ; +if (code =RECORD_TYPE || code =UNION_TYPE ) { +if (!is_pure_ops_struct (fieldtype)) +return 0 ; + } -if (!is_pure_ops_struct (fieldtype)) +if (!is_fptr (fieldtype))return 0 ; }Signature · 1 line
2.17.1Signature · 1 line
Kees Cook