lkdtm: hide stack overflow warning for corrupt-stack test
Arnd Bergmann
maintainerPATCH 1/1 lkdtm: hide stack overflow warning for corrupt-stack test
After the latest change to make sure the compiler actually does a memset, it is now smart enough to flag the stack overflow at compile time, at least with gcc-7.0:
drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
To outsmart the compiler again, this moves the memset into a noinline function where (for now) it doesn't see that we intentionally write broken code here.
--- drivers/misc/lkdtm_bugs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
drivers/misc/lkdtm_bugs.c +6 -1
@@ -80,12 +80,17 @@ void lkdtm_OVERFLOW(void) (void )recursive_loop (recur_count); } +static noinline void __lkdtm_CORRUPT_STACK(void *stack) +{ +memset (stack,'a' ,64 ); +} + noinline void lkdtm_CORRUPT_STACK(void) {/* Use default char array length that triggers stack protection. */ char data[8 ]; +__lkdtm_CORRUPT_STACK (&data); -memset ((void *)data,'a' ,64 );pr_info ("Corrupted stack with '%16s'...\n" , data); }
Signature · 1 line
2.9.0
Quoted 7 lines · Arnd Bergmann
After the latest change to make sure the compiler actually does a memset, it is now smart enough to flag the stack overflow at compile time, at least with gcc-7.0:
drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
Quoted 6 lines
To outsmart the compiler again, this moves the memset into a noinline function where (for now) it doesn't see that we intentionally write broken code here.
Fixes c55d240003ae ("lkdtm: Prevent the compiler from optimising lkdtm_CORRUPT_STACK()")Signed-off-by Arnd Bergmann <[email protected]>
Hah. Yes, works for me. :)
-Kees
Quoted 30 lines
--- drivers/misc/lkdtm_bugs.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)drivers/misc/lkdtm_bugs.c +6
-2@@ -80,12 +80,17 @@ void lkdtm_OVERFLOW(void) (void )recursive_loop (recur_count); } +static noinline void __lkdtm_CORRUPT_STACK(void *stack) +{ +memset (stack,'a' ,64 ); +} + noinline void lkdtm_CORRUPT_STACK(void) {/* Use default char array length that triggers stack protection. */ char data[8 ]; +__lkdtm_CORRUPT_STACK (&data); -memset ((void *)data,'a' ,64 );pr_info ("Corrupted stack with '%16s'...\n" , data); } --2.9.0
Signature · 2 lines
Kees Cook Nexus Security
Quoted 10 lines · Arnd Bergmann
After the latest change to make sure the compiler actually does a memset, it is now smart enough to flag the stack overflow at compile time, at least with gcc-7.0:
drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]To outsmart the compiler again, this moves the memset into a noinline function where (for now) it doesn't see that we intentionally write broken code here.
Heh, darn it.
I suspect this is an arms race we are eventually going to lose. At some point we might have to switch to writing some of these in asm :/
cheers
Quoted 9 lines · Michael Ellerman
Quoted 7 lines · Arnd Bergmann
After the latest change to make sure the compiler actually does a memset, it is now smart enough to flag the stack overflow at compile time, at least with gcc-7.0:
drivers/misc/lkdtm_bugs.c: In function 'lkdtm_CORRUPT_STACK':drivers/misc/lkdtm_bugs.c:88:144: warning: 'memset' writing 64 bytes into a region of size 8 overflows the destination [-Wstringop-overflow=]
Quoted 8 lines
Quoted 3 lines
To outsmart the compiler again, this moves the memset into a noinline function where (for now) it doesn't see that we intentionally write broken code here.
Heh, darn it.
I suspect this is an arms race we are eventually going to lose. At some point we might have to switch to writing some of these in asm :/
Yeah, though I'm going to keep trying to avoid this as much as possible. I was almost there when building the .rodata execution test, but I found horrible tricks. :P
-Kees
Signature · 2 lines
Kees Cook Nexus Security