ubsan: Introduce wrap-around sanitizers
Subsystems (23)
cover ubsan: Introduce wrap-around sanitizers
Hi,
Lay the ground work for gaining instrumentation for signed[1], unsigned[2], and pointer[3] wrap-around by making all 3 sanitizers available for testing. Additionally gets x86_64 bootable under the unsigned sanitizer for the first time.
The compilers will need work before this can be generally useful, as the signed and pointer sanitizers are effectively a no-op with the kernel's required use of -fno-strict-overflow. The unsigned sanitizer will also need adjustment to deal with the many common code patterns that exist for unsigned wrap-around (e.g. "while (var--)", "-1UL", etc).
-Kees
Kees Cook (6):
ubsan: Use Clang's -fsanitize-trap=undefined option
ubsan: Reintroduce signed and unsigned overflow sanitizers
ubsan: Introduce CONFIG_UBSAN_POINTER_WRAP
ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
ubsan: Split wrapping sanitizer Makefile rules
ubsan: Get x86_64 booting with unsigned wrap-around sanitizer
Documentation/dev-tools/ubsan.rst | 28 +++------- arch/arm/Kconfig | 2 +- arch/arm64/Kconfig | 2 +- arch/mips/Kconfig | 2 +- arch/parisc/Kconfig | 2 +- arch/powerpc/Kconfig | 2 +- arch/riscv/Kconfig | 2 +- arch/s390/Kconfig | 2 +- arch/x86/Kconfig | 2 +- arch/x86/kernel/Makefile | 1 + arch/x86/kernel/apic/Makefile | 1 + arch/x86/mm/Makefile | 1 + arch/x86/mm/pat/Makefile | 1 + crypto/Makefile | 1 + drivers/acpi/Makefile | 1 + include/linux/compiler_types.h | 19 ++++++- kernel/Makefile | 1 + kernel/locking/Makefile | 1 + kernel/rcu/Makefile | 1 + kernel/sched/Makefile | 1 + lib/Kconfig.ubsan | 41 +++++++++----- lib/Makefile | 1 + lib/crypto/Makefile | 1 + lib/crypto/mpi/Makefile | 1 + lib/test_ubsan.c | 82 ++++++++++++++++++++++++++++ lib/ubsan.c | 89 +++++++++++++++++++++++++++++++ lib/ubsan.h | 5 ++ lib/zlib_deflate/Makefile | 1 + lib/zstd/Makefile | 2 + mm/Makefile | 1 + net/core/Makefile | 1 + net/ipv4/Makefile | 1 + scripts/Makefile.lib | 11 +++- scripts/Makefile.ubsan | 11 +++- 34 files changed, 278 insertions(+), 43 deletions(-)
Signature · 1 line
2.34.1
PATCH 1/6 ubsan: Use Clang's -fsanitize-trap=undefined option
Clang changed the way it enables UBSan trapping mode. Update the Makefile logic to discover it.
--- scripts/Makefile.ubsan | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
scripts/Makefile.ubsan +1 -1
@@ -10,6 +10,6 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum -ubsan-cflags-$(CONFIG_UBSAN_TRAP) += -fsanitize-undefined-trap-on-error +ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error) export CFLAGS_UBSAN := $(ubsan-cflags-y)
Signature · 1 line
2.34.1
Re: [PATCH 1/6] ubsan: Use Clang's -fsanitize-trap=undefined option
Quoted 32 lines · Kees Cook
Clang changed the way it enables UBSan trapping mode. Update the
Makefilelogic to discover it.Suggested-by Fangrui Song <[email protected]>Link https://lore.kernel.org/lkml/CAFP8O3JivZh+AAV7N90Nk7U2BHRNST6MRP0zHtfQ-Vj0m4+pDA@mail.gmail.com/ open hereCc Nathan Chancellor <[email protected]>Cc Masahiro Yamada <[email protected]>Cc Nicolas Schier <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Bill Wendling <[email protected]>Cc Justin Stitt <[email protected]>Signed-off-by Kees Cook <[email protected]>--- scripts/Makefile.ubsan | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)scripts/Makefile.ubsan +1
-2@@ -10,6 +10,6 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum -ubsan-cflags-$(CONFIG_UBSAN_TRAP) += -fsanitize-undefined-trap-on-error +ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error) export CFLAGS_UBSAN := $(ubsan-cflags-y) --
Quoted 1 line
2.34.1
Thanks for the patch. Clang has had -fsanitize-trap= since 2015. GCC added -fsanitize-trap=undefined in 2022
(https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=2c7cfc7b418564 ;
milestone: 13.1), so we cannot use -fsanitize-trap=undefined unconditionally.
--
宋方睿
PATCH 2/6 ubsan: Reintroduce signed and unsigned overflow sanitizers
In reply to Kees CookEffectively revert commit 6aaa31aeb9cf ("ubsan: remove overflow checks"), to allow the kernel to be built with the "overflow" sanitizers again. This gives developers a chance to experiment[1][2][3] with the instrumentation again, while compilers adjust their sanitizers to deal with the impact of -fno-strict-oveflow (i.e. moving from "overflow" checking to "wrap-around" checking).
Notably, the naming of the options is adjusted to use the name "WRAP" instead of "OVERFLOW". In the strictest sense, arithmetic "overflow" happens when a result exceeds the storage of the type, and is considered by the C standard and compilers to be undefined behavior for signed and pointer types (without -fno-strict-overflow). Unsigned arithmetic overflow is defined as always wrapping around.
Because the kernel is built with -fno-strict-overflow, signed and pointer arithmetic is defined to always wrap around instead of "overflowing" (which could either be elided due to being undefined behavior or would wrap around, which led to very weird bugs in the kernel).
So, the config options are added back as CONFIG_UBSAN_SIGNED_WRAP and CONFIG_UBSAN_UNSIGNED_WRAP. Since the kernel has several places that explicitly depend on wrap-around behavior (e.g. counters, atomics, crypto, etc), also introduce the __signed_wrap and __unsigned_wrap function attributes for annotating functions where wrapping is expected and should not be instrumented. This will allow us to distinguish in the kernel between intentional and unintentional cases of arithmetic wrap-around.
Additionally keep these disabled under CONFIG_COMPILE_TEST for now.
--- include/linux/compiler_types.h | 14 ++++++- lib/Kconfig.ubsan | 19 ++++++++++ lib/test_ubsan.c | 49 ++++++++++++++++++++++++ lib/ubsan.c | 68 ++++++++++++++++++++++++++++++++++ lib/ubsan.h | 4 ++ scripts/Makefile.ubsan | 2 + 6 files changed, 155 insertions(+), 1 deletion(-)
include/linux/compiler_types.h +13 -1
@@ -282,11 +282,23 @@ struct ftrace_likely_data {#define __no_sanitize_or_inline __always_inline#endif +/* Allow wrapping arithmetic within an annotated function. */ +#ifdef CONFIG_UBSAN_SIGNED_WRAP +# define __signed_wrap __attribute__((no_sanitize("signed-integer-overflow"))) +#else +# define __signed_wrap +#endif +#ifdef CONFIG_UBSAN_UNSIGNED_WRAP +# define __unsigned_wrap __attribute__((no_sanitize("unsigned-integer-overflow"))) +#else +# define __unsigned_wrap +#endif +/* Section for code which can't be instrumented at all */ #define __noinstr_section (section) \ noinline notrace __attribute((__section__(section))) \ __no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \ - __no_sanitize_memory + __no_sanitize_memory __signed_wrap __unsigned_wrap#define noinstr __noinstr_section(".noinstr.text")
lib/Kconfig.ubsan +19 -0
@@ -116,6 +116,25 @@ config UBSAN_UNREACHABLE This option enables -fsanitize=unreachable which checks for control flow reaching an expected-to-be-unreachable position. +config UBSAN_SIGNED_WRAP + bool "Perform checking for signed arithmetic wrap-around" + default UBSAN + depends on !COMPILE_TEST + depends on $(cc-option,-fsanitize=signed-integer-overflow) + help + This option enables -fsanitize=signed-integer-overflow which checks + for wrap-around of any arithmetic operations with signed integers. + +config UBSAN_UNSIGNED_WRAP + bool "Perform checking for unsigned arithmetic wrap-around" + depends on $(cc-option,-fsanitize=unsigned-integer-overflow) + depends on !X86_32 # avoid excessive stack usage on x86-32/clang + depends on !COMPILE_TEST + help + This option enables -fsanitize=unsigned-integer-overflow which checks + for wrap-around of any arithmetic operations with unsigned integers. This + currently causes x86 to fail to boot. + config UBSAN_BOOL bool "Perform checking for non-boolean values used as boolean" default UBSAN
lib/test_ubsan.c +49 -0
61 lines not on this page · raw message
lib/ubsan.c +68 -0
74 lines not on this page · raw message
lib/ubsan.h +4 -0
@@ -124,6 +124,10 @@ typedef s64 s_max;typedef u64 u_max ;#endif +void __ubsan_handle_add_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_sub_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_mul_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_negate_overflow (void *_data,void *old_val);void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs);void __ubsan_handle_type_mismatch (struct type_mismatch_data *data,void *ptr);void __ubsan_handle_type_mismatch_v1 (void *_data,void *ptr);
scripts/Makefile.ubsan +2 -0
@@ -8,6 +8,8 @@ ubsan-cflags-$(CONFIG_UBSAN_LOCAL_BOUNDS) += -fsanitize=local-bounds ubsan-cflags-$(CONFIG_UBSAN_SHIFT) += -fsanitize=shift ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable +ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow +ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error)
Signature · 1 line
2.34.1
Re: [PATCH 2/6] ubsan: Reintroduce signed and unsigned overflow sanitizers
Hi,
Quoted 27 lines · Kees Cook
Effectively revert commit
6aaa31aeb9cf("ubsan: remove overflow checks"), to allow the kernel to be built with the "overflow" sanitizers again. This gives developers a chance to experiment[1][2][3] with the instrumentation again, while compilers adjust their sanitizers to deal with the impact of -fno-strict-oveflow (i.e. moving from "overflow" checking to "wrap-around" checking).Notably, the naming of the options is adjusted to use the name "WRAP" instead of "OVERFLOW". In the strictest sense, arithmetic "overflow" happens when a result exceeds the storage of the type, and is considered by the C standard and compilers to be undefined behavior for signed and pointer types (without -fno-strict-overflow). Unsigned arithmetic overflow is defined as always wrapping around.
Because the kernel is built with -fno-strict-overflow, signed and pointer arithmetic is defined to always wrap around instead of "overflowing" (which could either be elided due to being undefined behavior or would wrap around, which led to very weird bugs in the kernel).
So, the config options are added back as
CONFIG_UBSAN_SIGNED_WRAPandCONFIG_UBSAN_UNSIGNED_WRAP. Since the kernel has several places that explicitly depend on wrap-around behavior (e.g. counters, atomics, crypto, etc), also introduce the__signed_wrapand__unsigned_wrapfunction attributes for annotating functions where wrapping is expected and should not be instrumented. This will allow us to distinguish in the kernel between intentional and unintentional cases of arithmetic wrap-around.
Quoted 1 line
Additionally keep these disabled under
CONFIG_COMPILE_TESTfor now.
This is present in the patch but perhaps its worth noting here that x86 has trouble booting with the unsigned-integer-overflow sanitizer on.
Quoted 13 lines
Cc Justin Stitt <[email protected]>Cc Miguel Ojeda <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Peter Zijlstra <[email protected]>Cc Marco Elver <[email protected]>Cc Hao Luo <[email protected]>Cc Przemek Kitszel <[email protected]>Signed-off-by Kees Cook <[email protected]>
This patch adheres to the language semantics as I understand them. Moreover, we would've had to send a patch similar to this once we land some better sanitizer + -fno-strict-oveflow support in the compilers.
Currently, though, -fsanitize=signed-integer-overflow instruments very little (if anything at all) due to compiler optimizations in conjunction with -fno-strict-oveflow. I am working on a new -fsanitize=signed-integer-wrap in Clang which will instrument more arithmetic even under -fno-strict-oveflow.
Quoted 243 lines
--- include/linux/compiler_types.h | 14 ++++++- lib/Kconfig.ubsan | 19 ++++++++++ lib/test_ubsan.c | 49 ++++++++++++++++++++++++ lib/ubsan.c | 68 ++++++++++++++++++++++++++++++++++ lib/ubsan.h | 4 ++ scripts/Makefile.ubsan | 2 + 6 files changed, 155 insertions(+), 1 deletion(-)include/linux/compiler_types.h +13
-1@@ -282,11 +282,23 @@ struct ftrace_likely_data {#define __no_sanitize_or_inline __always_inline#endif +/* Allow wrapping arithmetic within an annotated function. */ +#ifdef CONFIG_UBSAN_SIGNED_WRAP +# define __signed_wrap __attribute__((no_sanitize("signed-integer-overflow"))) +#else +# define __signed_wrap +#endif +#ifdef CONFIG_UBSAN_UNSIGNED_WRAP +# define __unsigned_wrap __attribute__((no_sanitize("unsigned-integer-overflow"))) +#else +# define __unsigned_wrap +#endif +/* Section for code which can't be instrumented at all */ #define __noinstr_section (section) \ noinline notrace __attribute((__section__(section))) \ __no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \ - __no_sanitize_memory + __no_sanitize_memory __signed_wrap __unsigned_wrap#define noinstr __noinstr_section(".noinstr.text")lib/Kconfig.ubsan +19
-0@@ -116,6 +116,25 @@ config UBSAN_UNREACHABLE This option enables -fsanitize=unreachable which checks for control flow reaching an expected-to-be-unreachable position. +config UBSAN_SIGNED_WRAP + bool "Perform checking for signed arithmetic wrap-around" + default UBSAN + depends on !COMPILE_TEST + depends on $(cc-option,-fsanitize=signed-integer-overflow) + help + This option enables -fsanitize=signed-integer-overflow which checks + for wrap-around of any arithmetic operations with signed integers. + +config UBSAN_UNSIGNED_WRAP + bool "Perform checking for unsigned arithmetic wrap-around" + depends on $(cc-option,-fsanitize=unsigned-integer-overflow) + depends on !X86_32 # avoid excessive stack usage on x86-32/clang + depends on !COMPILE_TEST + help + This option enables -fsanitize=unsigned-integer-overflow which checks + for wrap-around of any arithmetic operations with unsigned integers. This + currently causes x86 to fail to boot. + config UBSAN_BOOL bool "Perform checking for non-boolean values used as boolean" default UBSANlib/test_ubsan.c +49
-0@@ -11,6 +11,51 @@ typedef void(*test_ubsan_fp)(void);#config , IS_ENABLED(config) ? "y" : "n"); \ } while (0) +static void test_ubsan_add_overflow (void ) +{ +volatile int val =INT_MAX ; +volatile unsigned int uval =UINT_MAX ; + +UBSAN_TEST (CONFIG_UBSAN_SIGNED_WRAP ); + val +=2 ; + +UBSAN_TEST (CONFIG_UBSAN_UNSIGNED_WRAP ); + uval +=2 ; +} + +static void test_ubsan_sub_overflow (void ) +{ +volatile int val =INT_MIN ; +volatile unsigned int uval =0 ; +volatile int val2 =2 ; + +UBSAN_TEST (CONFIG_UBSAN_SIGNED_WRAP ); + val -= val2; + +UBSAN_TEST (CONFIG_UBSAN_UNSIGNED_WRAP ); + uval -= val2; +} + +static void test_ubsan_mul_overflow (void ) +{ +volatile int val =INT_MAX /2 ; +volatile unsigned int uval =UINT_MAX /2 ; + +UBSAN_TEST (CONFIG_UBSAN_SIGNED_WRAP ); + val *=3 ; + +UBSAN_TEST (CONFIG_UBSAN_UNSIGNED_WRAP ); + uval *=3 ; +} + +static void test_ubsan_negate_overflow (void ) +{ +volatile int val =INT_MIN ; + +UBSAN_TEST (CONFIG_UBSAN_SIGNED_WRAP ); + val = -val; +} +static void test_ubsan_divrem_overflow (void ) {volatile int val =16 ;@@ -90,6 +135,10 @@ static void test_ubsan_misaligned_access(void) }static const test_ubsan_fp test_ubsan_array[] = { + test_ubsan_add_overflow, + test_ubsan_sub_overflow, + test_ubsan_mul_overflow, + test_ubsan_negate_overflow, test_ubsan_shift_out_of_bounds, test_ubsan_out_of_bounds, test_ubsan_load_invalid_value,lib/ubsan.c +68
-0@@ -222,6 +222,74 @@ static void ubsan_epilogue(void)check_panic_on_warn ("UBSAN" ); } +static void handle_overflow (struct overflow_data *data,void *lhs, +void *rhs,char op) +{ + +struct type_descriptor *type = data->type; +char lhs_val_str[VALUE_LENGTH ]; +char rhs_val_str[VALUE_LENGTH ]; + +if (suppress_report (&data->location)) +return ; + +ubsan_prologue (&data->location,type_is_signed (type) ? +"signed-integer-overflow" : +"unsigned-integer-overflow" ); + +val_to_string (lhs_val_str,sizeof (lhs_val_str), type, lhs); +val_to_string (rhs_val_str,sizeof (rhs_val_str), type, rhs); +pr_err ("%s %c %s cannot be represented in type %s\n" , + lhs_val_str, + op, + rhs_val_str, + type->type_name); + +ubsan_epilogue (); +} + +void __ubsan_handle_add_overflow (void *data, +void *lhs,void *rhs) +{ + +handle_overflow (data, lhs, rhs,'+' ); +} +EXPORT_SYMBOL (__ubsan_handle_add_overflow); + +void __ubsan_handle_sub_overflow (void *data, +void *lhs,void *rhs) +{ +handle_overflow (data, lhs, rhs,'-' ); +} +EXPORT_SYMBOL (__ubsan_handle_sub_overflow); + +void __ubsan_handle_mul_overflow (void *data, +void *lhs,void *rhs) +{ +handle_overflow (data, lhs, rhs,'*' ); +} +EXPORT_SYMBOL (__ubsan_handle_mul_overflow); + +void __ubsan_handle_negate_overflow (void *_data,void *old_val) +{ +struct overflow_data *data = _data; +char old_val_str[VALUE_LENGTH ]; + +if (suppress_report (&data->location)) +return ; + +ubsan_prologue (&data->location,"negation-overflow" ); + +val_to_string (old_val_str,sizeof (old_val_str), data->type, old_val); + +pr_err ("negation of %s cannot be represented in type %s:\n" , + old_val_str, data->type->type_name); + +ubsan_epilogue (); +} +EXPORT_SYMBOL (__ubsan_handle_negate_overflow); + +void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs) {struct overflow_data *data = _data;lib/ubsan.h +4
-0@@ -124,6 +124,10 @@ typedef s64 s_max;typedef u64 u_max ;#endif +void __ubsan_handle_add_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_sub_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_mul_overflow (void *data,void *lhs,void *rhs); +void __ubsan_handle_negate_overflow (void *_data,void *old_val);void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs);void __ubsan_handle_type_mismatch (struct type_mismatch_data *data,void *ptr);void __ubsan_handle_type_mismatch_v1 (void *_data,void *ptr);scripts/Makefile.ubsan +2
-1@@ -8,6 +8,8 @@ ubsan-cflags-$(CONFIG_UBSAN_LOCAL_BOUNDS) += -fsanitize=local-bounds ubsan-cflags-$(CONFIG_UBSAN_SHIFT) += -fsanitize=shift ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable +ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow +ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error) --
Quoted 2 lines
2.34.1
Thanks
Justin
Re: [PATCH 2/6] ubsan: Reintroduce signed and unsigned overflow sanitizers
Quoted 30 lines · Justin Stitt
Hi,
Quoted 27 lines · Kees Cook
Effectively revert commit
6aaa31aeb9cf("ubsan: remove overflow checks"), to allow the kernel to be built with the "overflow" sanitizers again. This gives developers a chance to experiment[1][2][3] with the instrumentation again, while compilers adjust their sanitizers to deal with the impact of -fno-strict-oveflow (i.e. moving from "overflow" checking to "wrap-around" checking).Notably, the naming of the options is adjusted to use the name "WRAP" instead of "OVERFLOW". In the strictest sense, arithmetic "overflow" happens when a result exceeds the storage of the type, and is considered by the C standard and compilers to be undefined behavior for signed and pointer types (without -fno-strict-overflow). Unsigned arithmetic overflow is defined as always wrapping around.
Because the kernel is built with -fno-strict-overflow, signed and pointer arithmetic is defined to always wrap around instead of "overflowing" (which could either be elided due to being undefined behavior or would wrap around, which led to very weird bugs in the kernel).
So, the config options are added back as
CONFIG_UBSAN_SIGNED_WRAPandCONFIG_UBSAN_UNSIGNED_WRAP. Since the kernel has several places that explicitly depend on wrap-around behavior (e.g. counters, atomics, crypto, etc), also introduce the__signed_wrapand__unsigned_wrapfunction attributes for annotating functions where wrapping is expected and should not be instrumented. This will allow us to distinguish in the kernel between intentional and unintentional cases of arithmetic wrap-around.
Quoted 4 lines
Quoted 1 line
Additionally keep these disabled under
CONFIG_COMPILE_TESTfor now.This is present in the patch but perhaps its worth noting here that x86 has trouble booting with the unsigned-integer-overflow sanitizer on.
Yeah, though this is fixed later in the series.
Quoted 20 lines
Quoted 14 lines
Cc Justin Stitt <[email protected]>Cc Miguel Ojeda <[email protected]>Cc Nathan Chancellor <[email protected]>Cc Nick Desaulniers <[email protected]>Cc Peter Zijlstra <[email protected]>Cc Marco Elver <[email protected]>Cc Hao Luo <[email protected]>Cc Przemek Kitszel <[email protected]>Signed-off-by Kees Cook <[email protected]>This patch adheres to the language semantics as I understand them. Moreover, we would've had to send a patch similar to this once we land some better sanitizer + -fno-strict-oveflow support in the compilers.
Quoted 5 lines
Currently, though, -fsanitize=signed-integer-overflow instruments very little (if anything at all) due to compiler optimizations in conjunction with -fno-strict-oveflow. I am working on a new -fsanitize=signed-integer-wrap in Clang which will instrument more arithmetic even under -fno-strict-oveflow.
Agreed -- I'm mainly getting these back into the kernel so folks working on this have a common base to work from.
Quoted 1 line
Reviewed-by Justin Stitt <[email protected]>
Thanks!
-Kees
Signature · 1 line
Kees Cook
PATCH 3/6 ubsan: Introduce CONFIG_UBSAN_POINTER_WRAP
In reply to Kees CookGain coverage for pointer wrap-around checking. Adds support for -fsanitize=pointer-overflow, and introduces the __pointer_wrap function attribute to match the signed and unsigned attributes. Also like the others, it is currently disabled under CONFIG_COMPILE_TEST.
--- include/linux/compiler_types.h | 7 ++++++- lib/Kconfig.ubsan | 8 ++++++++ lib/test_ubsan.c | 33 +++++++++++++++++++++++++++++++++ lib/ubsan.c | 21 +++++++++++++++++++++ lib/ubsan.h | 1 + scripts/Makefile.ubsan | 1 + 6 files changed, 70 insertions(+), 1 deletion(-)
include/linux/compiler_types.h +6 -1
@@ -293,12 +293,17 @@ struct ftrace_likely_data {#else # define __unsigned_wrap#endif +#ifdef CONFIG_UBSAN_POINTER_WRAP +# define __pointer_wrap __attribute__((no_sanitize("pointer-overflow"))) +#else +# define __pointer_wrap +#endif /* Section for code which can't be instrumented at all */ #define __noinstr_section (section) \ noinline notrace __attribute((__section__(section))) \ __no_kcsan __no_sanitize_address __no_profile __no_sanitize_coverage \ - __no_sanitize_memory __signed_wrap __unsigned_wrap + __no_sanitize_memory __signed_wrap __unsigned_wrap __pointer_wrap#define noinstr __noinstr_section(".noinstr.text")
lib/Kconfig.ubsan +8 -0
@@ -135,6 +135,14 @@ config UBSAN_UNSIGNED_WRAP for wrap-around of any arithmetic operations with unsigned integers. This currently causes x86 to fail to boot. +config UBSAN_POINTER_WRAP + bool "Perform checking for pointer arithmetic wrap-around" + depends on !COMPILE_TEST + depends on $(cc-option,-fsanitize=pointer-overflow) + help + This option enables -fsanitize=pointer-overflow which checks + for wrap-around of any arithmetic operations with pointers. + config UBSAN_BOOL bool "Perform checking for non-boolean values used as boolean" default UBSAN
lib/test_ubsan.c +33 -0
@@ -56,6 +56,36 @@ static void test_ubsan_negate_overflow(void) val = -val; } +static void test_ubsan_pointer_overflow_add (void ) +{ +volatile void *top = (void *)ULONG_MAX ; + +UBSAN_TEST (CONFIG_UBSAN_POINTER_WRAP ); + top +=2 ; +} + +static void test_ubsan_pointer_overflow_sub (void ) +{ +volatile void *bottom = (void *)1 ; + +UBSAN_TEST (CONFIG_UBSAN_POINTER_WRAP ); + bottom -=3 ; +} + +struct ptr_wrap { +int a; +int b; +}; + +static void test_ubsan_pointer_overflow_mul (void ) +{ +volatile struct ptr_wrap *half = (void *)(ULONG_MAX -128 ); +volatile int bump =128 ; + +UBSAN_TEST (CONFIG_UBSAN_POINTER_WRAP ); + half += bump; +} +static void test_ubsan_divrem_overflow (void ) {volatile int val =16 ;
@@ -139,6 +169,9 @@ static const test_ubsan_fp test_ubsan_array[] = { test_ubsan_sub_overflow, test_ubsan_mul_overflow, test_ubsan_negate_overflow, + test_ubsan_pointer_overflow_add, + test_ubsan_pointer_overflow_sub, + test_ubsan_pointer_overflow_mul, test_ubsan_shift_out_of_bounds, test_ubsan_out_of_bounds, test_ubsan_load_invalid_value,
lib/ubsan.c +21 -0
@@ -289,6 +289,27 @@ void __ubsan_handle_negate_overflow(void *_data, void *old_val) }EXPORT_SYMBOL (__ubsan_handle_negate_overflow); +void __ubsan_handle_pointer_overflow (void *_data,void *lhs,void *rhs) +{ +struct overflow_data *data = _data; +unsigned long before = (unsigned long )lhs; +unsigned long after = (unsigned long )rhs; + +if (suppress_report (&data->location)) +return ; + +ubsan_prologue (&data->location,"pointer-overflow" ); + +if (after ==0 ) +pr_err ("overflow wrapped to NULL\n" ); +else if (after < before) +pr_err ("overflow wrap-around\n" ); +else +pr_err ("underflow wrap-around\n" ); + +ubsan_epilogue (); +} +EXPORT_SYMBOL (__ubsan_handle_pointer_overflow);void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs) {
lib/ubsan.h +1 -0
@@ -128,6 +128,7 @@ void __ubsan_handle_add_overflow(void *data, void *lhs, void *rhs);void __ubsan_handle_sub_overflow (void *data,void *lhs,void *rhs);void __ubsan_handle_mul_overflow (void *data,void *lhs,void *rhs);void __ubsan_handle_negate_overflow (void *_data,void *old_val); +void __ubsan_handle_pointer_overflow (void *_data,void *lhs,void *rhs);void __ubsan_handle_divrem_overflow (void *_data,void *lhs,void *rhs);void __ubsan_handle_type_mismatch (struct type_mismatch_data *data,void *ptr);void __ubsan_handle_type_mismatch_v1 (void *_data,void *ptr);
scripts/Makefile.ubsan +1 -0
@@ -10,6 +10,7 @@ ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow +ubsan-cflags-$(CONFIG_UBSAN_POINTER_WRAP) += -fsanitize=pointer-overflow ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error)
Signature · 1 line
2.34.1
PATCH 4/6 ubsan: Remove CONFIG_UBSAN_SANITIZE_ALL
In reply to Kees CookFor simplicity in splitting out UBSan options into separate rules, remove CONFIG_UBSAN_SANITIZE_ALL, effectively defaulting to "y", which is how it is generally used anyway. (There are no ":= y" cases beyond where a specific file is enabled when a top-level ":= n" is in effect.)
--- Documentation/dev-tools/ubsan.rst | 28 ++++++++-------------------- arch/arm/Kconfig | 2 +- arch/arm64/Kconfig | 2 +- arch/mips/Kconfig | 2 +- arch/parisc/Kconfig | 2 +- arch/powerpc/Kconfig | 2 +- arch/riscv/Kconfig | 2 +- arch/s390/Kconfig | 2 +- arch/x86/Kconfig | 2 +- lib/Kconfig.ubsan | 13 +------------ scripts/Makefile.lib | 2 +- 11 files changed, 18 insertions(+), 41 deletions(-)
Documentation/dev-tools/ubsan.rst +8 -20
@@ -49,34 +49,22 @@ Report example Usage ----- -To enable UBSAN configure kernel with:: +To enable UBSAN, configure the kernel with:: - CONFIG_UBSAN=y + CONFIG_UBSAN=y -and to check the entire kernel:: - - CONFIG_UBSAN_SANITIZE_ALL=y - -To enable instrumentation for specific files or directories, add a line -similar to the following to the respective kernel Makefile: - -- For a single file (e.g. main.o):: - - UBSAN_SANITIZE_main.o := y - -- For all files in one directory:: - - UBSAN_SANITIZE := y - -To exclude files from being instrumented even if -``CONFIG_UBSAN_SANITIZE_ALL=y``, use:: +To exclude files from being instrumented use:: UBSAN_SANITIZE_main.o := n -and:: +and to exclude all targets in one directory use:: UBSAN_SANITIZE := n +When disabled for all targets, specific files can be enabled using:: + + UBSAN_SANITIZE_main.o := y + Detection of unaligned accesses controlled through the separate option - CONFIG_UBSAN_ALIGNMENT. It's off by default on architectures that support unaligned accesses (CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y). One could
arch/arm/Kconfig +1 -1
@@ -29,7 +29,7 @@ config ARM select ARCH_HAVE_NMI_SAFE_CMPXCHG if CPU_V7 || CPU_V7M || CPU_V6K select ARCH_HAS_GCOV_PROFILE_ALL select ARCH_KEEP_MEMBLOCK - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_MIGHT_HAVE_PC_PARPORT select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX select ARCH_OPTIONAL_KERNEL_RWX_DEFAULT if CPU_V7
arch/arm64/Kconfig +1 -1
@@ -107,7 +107,7 @@ config ARM64 select ARCH_WANT_LD_ORPHAN_WARN select ARCH_WANTS_NO_INSTR select ARCH_WANTS_THP_SWAP if ARM64_4K_PAGES - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARM_AMBA select ARM_ARCH_TIMER select ARM_GIC
arch/mips/Kconfig +1 -1
@@ -14,7 +14,7 @@ config MIPS select ARCH_HAS_STRNCPY_FROM_USER select ARCH_HAS_STRNLEN_USER select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAS_GCOV_PROFILE_ALL select ARCH_KEEP_MEMBLOCK select ARCH_USE_BUILTIN_BSWAP
arch/parisc/Kconfig +1 -1
@@ -12,7 +12,7 @@ config PARISC select ARCH_HAS_ELF_RANDOMIZE select ARCH_HAS_STRICT_KERNEL_RWX select ARCH_HAS_STRICT_MODULE_RWX - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAS_PTE_SPECIAL select ARCH_NO_SG_CHAIN select ARCH_SUPPORTS_HUGETLBFS if PA20
arch/powerpc/Kconfig +1 -1
@@ -154,7 +154,7 @@ config PPC select ARCH_HAS_SYSCALL_WRAPPER if !SPU_BASE && !COMPAT select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST select ARCH_HAS_UACCESS_FLUSHCACHE - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAVE_NMI_SAFE_CMPXCHG select ARCH_KEEP_MEMBLOCK select ARCH_MHP_MEMMAP_ON_MEMORY_ENABLE if PPC_RADIX_MMU
arch/riscv/Kconfig +1 -1
@@ -37,7 +37,7 @@ config RISCV select ARCH_HAS_STRICT_MODULE_RWX if MMU && !XIP_KERNEL select ARCH_HAS_SYSCALL_WRAPPER select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAS_VDSO_DATA select ARCH_KEEP_MEMBLOCK if ACPI select ARCH_OPTIONAL_KERNEL_RWX if ARCH_HAS_STRICT_KERNEL_RWX
arch/s390/Kconfig +1 -1
@@ -82,7 +82,7 @@ config S390 select ARCH_HAS_STRICT_KERNEL_RWX select ARCH_HAS_STRICT_MODULE_RWX select ARCH_HAS_SYSCALL_WRAPPER - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAS_VDSO_DATA select ARCH_HAVE_NMI_SAFE_CMPXCHG select ARCH_INLINE_READ_LOCK
arch/x86/Kconfig +1 -1
@@ -100,7 +100,7 @@ config X86 select ARCH_HAS_STRICT_MODULE_RWX select ARCH_HAS_SYNC_CORE_BEFORE_USERMODE select ARCH_HAS_SYSCALL_WRAPPER - select ARCH_HAS_UBSAN_SANITIZE_ALL + select ARCH_HAS_UBSAN select ARCH_HAS_DEBUG_WX select ARCH_HAS_ZONE_DMA_SET if EXPERT select ARCH_HAVE_NMI_SAFE_CMPXCHG
lib/Kconfig.ubsan +1 -12
@@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0-only -config ARCH_HAS_UBSAN_SANITIZE_ALL +config ARCH_HAS_UBSAN bool menuconfig UBSAN
@@ -169,17 +169,6 @@ config UBSAN_ALIGNMENT Enabling this option on architectures that support unaligned accesses may produce a lot of false positives. -config UBSAN_SANITIZE_ALL - bool "Enable instrumentation for the entire kernel" - depends on ARCH_HAS_UBSAN_SANITIZE_ALL - default y - help - This option activates instrumentation for the entire kernel. - If you don't enable this option, you have to explicitly specify - UBSAN_SANITIZE := y for the files/directories you want to check for UB. - Enabling this option will get kernel image size increased - significantly. - config TEST_UBSAN tristate "Module for testing for undefined behavior detection" depends on m
scripts/Makefile.lib +1 -1
@@ -175,7 +175,7 @@ endif ifeq ($(CONFIG_UBSAN),y) _c_flags += $(if $(patsubst n%,, \ - $(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)$(CONFIG_UBSAN_SANITIZE_ALL)), \ + $(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)y), \ $(CFLAGS_UBSAN)) endif
Signature · 1 line
2.34.1
PATCH 5/6 ubsan: Split wrapping sanitizer Makefile rules
In reply to Kees CookTo allow for fine-grained control of where the wrapping sanitizers can be disabled, split them from the main UBSAN CFLAGS into their own set of rules.
--- scripts/Makefile.lib | 9 +++++++++ scripts/Makefile.ubsan | 12 +++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-)
scripts/Makefile.lib +9 -0
@@ -177,6 +177,15 @@ ifeq ($(CONFIG_UBSAN),y) _c_flags += $(if $(patsubst n%,, \ $(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_SANITIZE)y), \ $(CFLAGS_UBSAN)) +_c_flags += $(if $(patsubst n%,, \ + $(UBSAN_WRAP_SIGNED_$(basetarget).o)$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_WRAP_SIGNED)$(UBSAN_SANITIZE)y), \ + $(CFLAGS_UBSAN_WRAP_SIGNED)) +_c_flags += $(if $(patsubst n%,, \ + $(UBSAN_WRAP_UNSIGNED_$(basetarget).o)$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_WRAP_UNSIGNED)$(UBSAN_SANITIZE)y), \ + $(CFLAGS_UBSAN_WRAP_UNSIGNED)) +_c_flags += $(if $(patsubst n%,, \ + $(UBSAN_WRAP_POINTER_$(basetarget).o)$(UBSAN_SANITIZE_$(basetarget).o)$(UBSAN_WRAP_POINTER)$(UBSAN_SANITIZE)y), \ + $(CFLAGS_UBSAN_WRAP_POINTER)) endif ifeq ($(CONFIG_KCOV),y)
scripts/Makefile.ubsan +9 -3
@@ -8,11 +8,17 @@ ubsan-cflags-$(CONFIG_UBSAN_LOCAL_BOUNDS) += -fsanitize=local-bounds ubsan-cflags-$(CONFIG_UBSAN_SHIFT) += -fsanitize=shift ubsan-cflags-$(CONFIG_UBSAN_DIV_ZERO) += -fsanitize=integer-divide-by-zero ubsan-cflags-$(CONFIG_UBSAN_UNREACHABLE) += -fsanitize=unreachable -ubsan-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow -ubsan-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow -ubsan-cflags-$(CONFIG_UBSAN_POINTER_WRAP) += -fsanitize=pointer-overflow ubsan-cflags-$(CONFIG_UBSAN_BOOL) += -fsanitize=bool ubsan-cflags-$(CONFIG_UBSAN_ENUM) += -fsanitize=enum ubsan-cflags-$(CONFIG_UBSAN_TRAP) += $(call cc-option,-fsanitize-trap=undefined,-fsanitize-undefined-trap-on-error) export CFLAGS_UBSAN := $(ubsan-cflags-y) + +ubsan-wrap-signed-cflags-$(CONFIG_UBSAN_SIGNED_WRAP) += -fsanitize=signed-integer-overflow +export CFLAGS_UBSAN_WRAP_SIGNED := $(ubsan-wrap-signed-cflags-y) + +ubsan-wrap-unsigned-cflags-$(CONFIG_UBSAN_UNSIGNED_WRAP) += -fsanitize=unsigned-integer-overflow +export CFLAGS_UBSAN_WRAP_UNSIGNED := $(ubsan-wrap-unsigned-cflags-y) + +ubsan-wrap-pointer-cflags-$(CONFIG_UBSAN_POINTER_WRAP) += -fsanitize=pointer-overflow +export CFLAGS_UBSAN_WRAP_POINTER := $(ubsan-wrap-pointer-cflags-y)
Signature · 1 line
2.34.1
PATCH 6/6 ubsan: Get x86_64 booting with unsigned wrap-around sanitizer
In reply to Kees CookIn order to get x86_64 booting with the unsigned wrap-around sanitizer, several kernel areas that depend heavily on unsigned wrap-around need to be disabled entirely (with "UBSAN_UNSIGNED_WRAP := n"). As we fine-tune the sanitizer, we can revisit these and perform finer grain annotations.
--- arch/x86/kernel/Makefile | 1 + arch/x86/kernel/apic/Makefile | 1 + arch/x86/mm/Makefile | 1 + arch/x86/mm/pat/Makefile | 1 + crypto/Makefile | 1 + drivers/acpi/Makefile | 1 + kernel/Makefile | 1 + kernel/locking/Makefile | 1 + kernel/rcu/Makefile | 1 + kernel/sched/Makefile | 1 + lib/Kconfig.ubsan | 5 +++-- lib/Makefile | 1 + lib/crypto/Makefile | 1 + lib/crypto/mpi/Makefile | 1 + lib/zlib_deflate/Makefile | 1 + lib/zstd/Makefile | 2 ++ mm/Makefile | 1 + net/core/Makefile | 1 + net/ipv4/Makefile | 1 + 19 files changed, 22 insertions(+), 2 deletions(-)
arch/x86/kernel/Makefile +1 -0
@@ -30,6 +30,7 @@ KASAN_SANITIZE_sev.o := n # With some compiler versions the generated code results in boot hangs, caused # by several compilation units. To be safe, disable all instrumentation. +UBSAN_WRAP_UNSIGNED := n KCSAN_SANITIZE := n KMSAN_SANITIZE_head$(BITS).o := n KMSAN_SANITIZE_nmi.o := n
arch/x86/kernel/apic/Makefile +1 -0
@@ -6,6 +6,7 @@ # Leads to non-deterministic coverage that is not a function of syscall inputs. # In particular, smp_apic_timer_interrupt() is called in random places. KCOV_INSTRUMENT := n +UBSAN_WRAP_UNSIGNED := n obj-$(CONFIG_X86_LOCAL_APIC) += apic.o apic_common.o apic_noop.o ipi.o vector.o init.o obj-y += hw_nmi.o
arch/x86/mm/Makefile +1 -0
@@ -1,5 +1,6 @@ # SPDX-License-Identifier: GPL-2.0 # Kernel does not boot with instrumentation of tlb.c and mem_encrypt*.c +UBSAN_WRAP_UNSIGNED := n KCOV_INSTRUMENT_tlb.o := n KCOV_INSTRUMENT_mem_encrypt.o := n KCOV_INSTRUMENT_mem_encrypt_amd.o := n
arch/x86/mm/pat/Makefile +1 -0
@@ -1,4 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 +UBSAN_WRAP_UNSIGNED := n obj-y := set_memory.o memtype.o
crypto/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Cryptographic API # +UBSAN_WRAP_UNSIGNED := n obj-$(CONFIG_CRYPTO) += crypto.o crypto-y := api.o cipher.o compress.o
drivers/acpi/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for the Linux ACPI interpreter # +UBSAN_WRAP_UNSIGNED := n ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT
kernel/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for the linux kernel. # +UBSAN_WRAP_UNSIGNED := n obj-y = fork.o exec_domain.o panic.o \ cpu.o exit.o softirq.o resource.o \
kernel/locking/Makefile +1 -0
@@ -2,6 +2,7 @@ # Any varying coverage in these files is non-deterministic # and is generally not a function of system call inputs. KCOV_INSTRUMENT := n +UBSAN_WRAP_UNSIGNED := n obj-y += mutex.o semaphore.o rwsem.o percpu-rwsem.o
kernel/rcu/Makefile +1 -0
@@ -2,6 +2,7 @@ # Any varying coverage in these files is non-deterministic # and is generally not a function of system call inputs. KCOV_INSTRUMENT := n +UBSAN_WRAP_UNSIGNED := n ifeq ($(CONFIG_KCSAN),y) KBUILD_CFLAGS += -g -fno-omit-frame-pointer
kernel/sched/Makefile +1 -0
@@ -7,6 +7,7 @@ ccflags-y += $(call cc-disable-warning, unused-but-set-variable) # These files are disabled because they produce non-interesting flaky coverage # that is not a function of syscall inputs. E.g. involuntary context switches. KCOV_INSTRUMENT := n +UBSAN_WRAP_UNSIGNED := n # Disable KCSAN to avoid excessive noise and performance degradation. To avoid # false positives ensure barriers implied by sched functions are instrumented.
lib/Kconfig.ubsan +3 -2
@@ -132,8 +132,9 @@ config UBSAN_UNSIGNED_WRAP depends on !COMPILE_TEST help This option enables -fsanitize=unsigned-integer-overflow which checks - for wrap-around of any arithmetic operations with unsigned integers. This - currently causes x86 to fail to boot. + for wrap-around of any arithmetic operations with unsigned integers. + Given the history of C and the many common code patterns involving + unsigned wrap-around, this is a very noisy option right now. config UBSAN_POINTER_WRAP bool "Perform checking for pointer arithmetic wrap-around"
lib/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for some libs needed in the kernel. # +UBSAN_WRAP_UNSIGNED := n ccflags-remove-$(CONFIG_FUNCTION_TRACER) += $(CC_FLAGS_FTRACE)
lib/crypto/Makefile +1 -0
@@ -1,4 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 +UBSAN_WRAP_UNSIGNED := n obj-$(CONFIG_CRYPTO_LIB_UTILS) += libcryptoutils.o libcryptoutils-y := memneq.o utils.o
lib/crypto/mpi/Makefile +1 -0
@@ -2,6 +2,7 @@ # # MPI multiprecision maths library (from gpg) # +UBSAN_WRAP_UNSIGNED := n obj-$(CONFIG_MPILIB) = mpi.o
lib/zlib_deflate/Makefile +1 -0
@@ -6,6 +6,7 @@ # This is the compression code, see zlib_inflate for the # decompression code. # +UBSAN_WRAP_UNSIGNED := n obj-$(CONFIG_ZLIB_DEFLATE) += zlib_deflate.o
lib/zstd/Makefile +2 -0
@@ -8,6 +8,8 @@ # in the COPYING file in the root directory of this source tree). # You may select, at your option, one of the above-listed licenses. # ################################################################ +UBSAN_WRAP_UNSIGNED := n + obj-$(CONFIG_ZSTD_COMPRESS) += zstd_compress.o obj-$(CONFIG_ZSTD_DECOMPRESS) += zstd_decompress.o obj-$(CONFIG_ZSTD_COMMON) += zstd_common.o
mm/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for the linux memory manager. # +UBSAN_WRAP_UNSIGNED := n KASAN_SANITIZE_slab_common.o := n KASAN_SANITIZE_slub.o := n
net/core/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for the Linux networking core. # +UBSAN_WRAP_UNSIGNED := n obj-y := sock.o request_sock.o skbuff.o datagram.o stream.o scm.o \ gen_stats.o gen_estimator.o net_namespace.o secure_seq.o \
net/ipv4/Makefile +1 -0
@@ -2,6 +2,7 @@ # # Makefile for the Linux TCP/IP (INET) layer. # +UBSAN_WRAP_UNSIGNED := n obj-y := route.o inetpeer.o protocol.o \ ip_input.o ip_fragment.o ip_forward.o ip_options.o \
Signature · 1 line
2.34.1