ubsan/overflow: Enable pattern exclusions

Hi Kees,

kernel test robot noticed the following build warnings:

[auto build test WARNING on kees/for-next/hardening]
[also build test WARNING on masahiroy-kbuild/for-next masahiroy-kbuild/fixes kees/for-next/pstore linus/master v6.14-rc6 next-20250307] [cannot apply to kees/for-next/kspp]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Kees-Cook/ubsan-overflow-Rework-integer-overflow-sanitizer-option-to-turn-on-everything/20250307-122130
base:   https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
patch link:    https://lore.kernel.org/r/20250307041914.937329-1-kees%40kernel.org
patch subject: [PATCH 1/3] ubsan/overflow: Rework integer overflow sanitizer option to turn on everything
config: s390-randconfig-r112-20250310 (https://download.01.org/0day-ci/archive/20250310/[email protected]/config)
compiler: s390-linux-gcc (GCC) 14.2.0
reproduce: (https://download.01.org/0day-ci/archive/20250310/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

sparse warnings: (new ones prefixed by >>)

Quoted 1 line

Quoted 1 line

lib/test_ubsan.c:62:16: sparse: sparse: cast truncates bits from constant value (7fffffffffffffff becomes ffffffff)

lib/test_ubsan.c:72:18: sparse: sparse: shift count is negative (-1)

vim +62 lib/test_ubsan.c

    55	
    56	static void test_ubsan_truncate_signed(void)
    57	{
    58		volatile long val = LONG_MAX;
    59		volatile int val2 = 0;
    60	
    61		UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);

Quoted 1 line

62 val2 = val;

    63	}
    64	

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Quoted 24 lines · kernel test robot

Hi Kees,

kernel test robot noticed the following build warnings:

[auto build test WARNING on kees/for-next/hardening]
[also build test WARNING on masahiroy-kbuild/for-next masahiroy-kbuild/fixes kees/for-next/pstore linus/master v6.14-rc6 next-20250307] [cannot apply to kees/for-next/kspp]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Kees-Cook/ubsan-overflow-Rework-integer-overflow-sanitizer-option-to-turn-on-everything/20250307-122130
base:   https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git for-next/hardening
patch link:    https://lore.kernel.org/r/20250307041914.937329-1-kees%40kernel.org
patch subject: [PATCH 1/3] ubsan/overflow: Rework integer overflow sanitizer option to turn on everything
config: s390-randconfig-r112-20250310 (https://download.01.org/0day-ci/archive/20250310/[email protected]/config)
compiler: s390-linux-gcc (GCC) 14.2.0
reproduce: (https://download.01.org/0day-ci/archive/20250310/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

Quoted 3 lines

sparse warnings: (new ones prefixed by >>)

Quoted 1 line

Quoted 1 line

lib/test_ubsan.c:62:16: sparse: sparse: cast truncates bits from constant value (7fffffffffffffff becomes ffffffff)

lib/test_ubsan.c:72:18: sparse: sparse: shift count is negative (-1)

Can we exclude certain source files from sparse? This whole file is basically an endless series of intentionally bad operations. :)

-Kees

Quoted 17 lines

vim +62 lib/test_ubsan.c

    55	
    56	static void test_ubsan_truncate_signed(void)
    57	{
    58		volatile long val = LONG_MAX;
    59		volatile int val2 = 0;
    60	
    61		UBSAN_TEST(CONFIG_UBSAN_INTEGER_WRAP);

Quoted 1 line

62 val2 = val;

    63	}
    64	

Signature · 2 lines

0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Signature · 1 line

Kees Cook

Since we're going to approach integer overflow mitigation a type at a time, we need to enable all of the associated sanitizers, and then opt into types one at a time.

Rename the existing "signed wrap" sanitizer to just the entire topic area:
"integer wrap". Enable the implicit integer truncation sanitizers, with required callbacks and tests.

Notably, this requires features (currently) only available in Clang, so we can depend on the cc-option tests to determine availability instead of doing version tests.

Signed-off-by Kees Cook <[email protected]>

---
Cc: Justin Stitt <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: Miguel Ojeda <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Cc: Hao Luo <[email protected]>
Cc: Przemek Kitszel <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 include/linux/compiler_types.h  |  2 +-
 kernel/configs/hardening.config |  2 +-
 lib/Kconfig.ubsan               | 23 +++++++++++------------
 lib/test_ubsan.c                | 18 ++++++++++++++----
 lib/ubsan.c                     | 28 ++++++++++++++++++++++++++--
 lib/ubsan.h                     |  8 ++++++++
 scripts/Makefile.lib            |  4 ++--
 scripts/Makefile.ubsan          |  8 ++++++--
 8 files changed, 69 insertions(+), 24 deletions(-)

include/linux/compiler_types.h +1 -1

index f59393464ea7..4ad3e900bc3d 100644
@@ -360,7 +360,7 @@ struct ftrace_likely_data {
 #endif
 
 /* Do not trap wrapping arithmetic within an annotated function. */
-#ifdef CONFIG_UBSAN_SIGNED_WRAP
+#ifdef CONFIG_UBSAN_INTEGER_WRAP
 # define __signed_wrap __attribute__((no_sanitize("signed-integer-overflow")))
 #else
 # define __signed_wrap

kernel/configs/hardening.config +1 -1

index 3fabb8f55ef6..dd7c32fb5ac1 100644
@@ -46,7 +46,7 @@ CONFIG_UBSAN_BOUNDS=y
 # CONFIG_UBSAN_SHIFT is not set
 # CONFIG_UBSAN_DIV_ZERO is not set
 # CONFIG_UBSAN_UNREACHABLE is not set
-# CONFIG_UBSAN_SIGNED_WRAP is not set
+# CONFIG_UBSAN_INTEGER_WRAP is not set
 # CONFIG_UBSAN_BOOL is not set
 # CONFIG_UBSAN_ENUM is not set
 # CONFIG_UBSAN_ALIGNMENT is not set

lib/Kconfig.ubsan +2 -5

index 1d4aa7a83b3a..63e5622010e0 100644
@@ -116,21 +116,20 @@ config UBSAN_UNREACHABLE
          This option enables -fsanitize=unreachable which checks for control
          flow reaching an expected-to-be-unreachable position.
 
-config UBSAN_SIGNED_WRAP
-       bool "Perform checking for signed arithmetic wrap-around"
+config UBSAN_INTEGER_WRAP
+       bool "Perform checking for integer arithmetic wrap-around"
        default UBSAN
        depends on !COMPILE_TEST
-       # The no_sanitize attribute was introduced in GCC with version 8.
-       depends on !CC_IS_GCC || GCC_VERSION >= 80000
        depends on $(cc-option,-fsanitize=signed-integer-overflow)
-       help

Quoted 93 lines · Kees Cook

Since we're going to approach integer overflow mitigation a type at a time, we need to enable all of the associated sanitizers, and then opt into types one at a time.

Rename the existing "signed wrap" sanitizer to just the entire topic area:
"integer wrap". Enable the implicit integer truncation sanitizers, with required callbacks and tests.

Notably, this requires features (currently) only available in Clang, so we can depend on the cc-option tests to determine availability instead of doing version tests.

Signed-off-by Kees Cook <[email protected]>

---
Cc: Justin Stitt <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: Miguel Ojeda <[email protected]>
Cc: Nick Desaulniers <[email protected]>
Cc: Hao Luo <[email protected]>
Cc: Przemek Kitszel <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 include/linux/compiler_types.h  |  2 +-
 kernel/configs/hardening.config |  2 +-
 lib/Kconfig.ubsan               | 23 +++++++++++------------
 lib/test_ubsan.c                | 18 ++++++++++++++----
 lib/ubsan.c                     | 28 ++++++++++++++++++++++++++--
 lib/ubsan.h                     |  8 ++++++++
 scripts/Makefile.lib            |  4 ++--
 scripts/Makefile.ubsan          |  8 ++++++--
 8 files changed, 69 insertions(+), 24 deletions(-)

include/linux/compiler_types.h +1 -1

index f59393464ea7..4ad3e900bc3d 100644
@@ -360,7 +360,7 @@ struct ftrace_likely_data {
 #endif
 
 /* Do not trap wrapping arithmetic within an annotated function. */
-#ifdef CONFIG_UBSAN_SIGNED_WRAP
+#ifdef CONFIG_UBSAN_INTEGER_WRAP
 # define __signed_wrap __attribute__((no_sanitize("signed-integer-overflow")))
 #else
 # define __signed_wrap

kernel/configs/hardening.config +1 -1

index 3fabb8f55ef6..dd7c32fb5ac1 100644
@@ -46,7 +46,7 @@ CONFIG_UBSAN_BOUNDS=y
 # CONFIG_UBSAN_SHIFT is not set
 # CONFIG_UBSAN_DIV_ZERO is not set
 # CONFIG_UBSAN_UNREACHABLE is not set
-# CONFIG_UBSAN_SIGNED_WRAP is not set
+# CONFIG_UBSAN_INTEGER_WRAP is not set
 # CONFIG_UBSAN_BOOL is not set
 # CONFIG_UBSAN_ENUM is not set
 # CONFIG_UBSAN_ALIGNMENT is not set

lib/Kconfig.ubsan +2 -12

index 1d4aa7a83b3a..63e5622010e0 100644
@@ -116,21 +116,20 @@ config UBSAN_UNREACHABLE
          This option enables -fsanitize=unreachable which checks for control
          flow reaching an expected-to-be-unreachable position.
 
-config UBSAN_SIGNED_WRAP
-       bool "Perform checking for signed arithmetic wrap-around"
+config UBSAN_INTEGER_WRAP
+       bool "Perform checking for integer arithmetic wrap-around"
        default UBSAN
        depends on !COMPILE_TEST
-       # The no_sanitize attribute was introduced in GCC with version 8.
-       depends on !CC_IS_GCC || GCC_VERSION >= 80000
        depends on $(cc-option,-fsanitize=signed-integer-overflow)
-       help
-         This option enables -fsanitize=signed-integer-overflow which checks
-         for wrap-around of any arithmetic operations with signed integers.
-         This currently performs nearly no instrumentation due to the
-         kernel's use of -fno-strict-overflow which converts all would-be
-         arithmetic undefined behavior into wrap-around arithmetic. Future
-         sanitizer versions will allow for wrap-around checking (rather than
-         exclusively undefined behavior).

lib/Kconfig.ubsan config UBSAN_UNREACHABLE · line 126

Quoted 3 lines

lib/Kconfig.ubsan +3 -0

+       depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
+       depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation)
+       depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation)

Can these be in 1 cc-option? I know it might look slightly more ugly, but having 3 different ones will shell out to the compiler 3 times, which is a little less efficient. At some point it might noticeably increase the build initialization latency.

To make integer wrap-around mitigation actually useful, the associated sanitizers must not instrument cases where the wrap-around is explicitly defined (e.g. "-2UL"), being tested for (e.g. "if (a + b < a)"), or where it has no impact on code flow (e.g. "while (var--)"). Enable pattern exclusions for the integer wrap sanitizers.

Signed-off-by Kees Cook <[email protected]>

---
Cc: Justin Stitt <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 lib/Kconfig.ubsan      | 1 +
 scripts/Makefile.ubsan | 1 +
 2 files changed, 2 insertions(+)

lib/Kconfig.ubsan +0 -0

index 63e5622010e0..888c2e72c586 100644

lib/Kconfig.ubsan +0 -0

 	depends on $(cc-option,-fsanitize=signed-integer-overflow)
 	depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
 	depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation)

scripts/Makefile.ubsan +1 -0

index 4fad9afed24c..233379c193a7 100644
@@ -15,6 +15,7 @@ ubsan-cflags-$(CONFIG_UBSAN_TRAP)		+= $(call cc-option,-fsanitize-trap=undefined
 export CFLAGS_UBSAN := $(ubsan-cflags-y)
 
 ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP)     +=	\
+	-fsanitize-undefined-ignore-overflow-pattern=all	\
 	-fsanitize=signed-integer-overflow			\
 	-fsanitize=unsigned-integer-overflow			\
 	-fsanitize=implicit-signed-integer-truncation		\

Signature · 1 line

2.34.1

Limit integer wrap-around mitigation to only the "size_t" type (for now). Notably this covers all special functions/builtins that return "size_t", like sizeof(). This remains an experimental feature and is likely to be replaced with type annotations.

Signed-off-by Kees Cook <[email protected]>

---
Cc: Justin Stitt <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 lib/Kconfig.ubsan               | 1 +
 scripts/Makefile.ubsan          | 3 ++-
 scripts/integer-wrap-ignore.scl | 3 +++
 3 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 scripts/integer-wrap-ignore.scl

lib/Kconfig.ubsan +1 -0

index 888c2e72c586..4216b3a4ff21 100644
@@ -125,6 +125,7 @@ config UBSAN_INTEGER_WRAP
 	depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
 	depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation)
 	depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation)
+	depends on $(cc-option,-fsanitize-ignorelist=/dev/null)
 	help
 	  This option enables all of the sanitizers involved in integer overflow
 	  (wrap-around) mitigation: signed-integer-overflow, unsigned-integer-overflow,

scripts/Makefile.ubsan +2 -1

index 233379c193a7..9e35198edbf0 100644
@@ -19,5 +19,6 @@ ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP)     +=	\
 	-fsanitize=signed-integer-overflow			\
 	-fsanitize=unsigned-integer-overflow			\
 	-fsanitize=implicit-signed-integer-truncation		\
-	-fsanitize=implicit-unsigned-integer-truncation
+	-fsanitize=implicit-unsigned-integer-truncation		\
+	-fsanitize-ignorelist=$(srctree)/scripts/integer-wrap-ignore.scl
 export CFLAGS_UBSAN_INTEGER_WRAP := $(ubsan-integer-wrap-cflags-y)

scripts/integer-wrap-ignore.scl new file +0 -0

new file mode 100644
index 000000000000..431c3053a4a2

Signature · 1 line

2.34.1

Limit integer wrap-around mitigation to only the "size_t" type (for now). Notably this covers all special functions/builtins that return "size_t", like sizeof(). This remains an experimental feature and is likely to be replaced with type annotations.

Signed-off-by Kees Cook <[email protected]>

---
Cc: Justin Stitt <[email protected]>
Cc: "Gustavo A. R. Silva" <[email protected]>
Cc: Marco Elver <[email protected]>
Cc: Andrey Konovalov <[email protected]>
Cc: Andrey Ryabinin <[email protected]>
Cc: Andrew Morton <[email protected]>
Cc: Masahiro Yamada <[email protected]>
Cc: Nathan Chancellor <[email protected]>
Cc: Nicolas Schier <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]

---
 lib/Kconfig.ubsan               | 1 +
 scripts/Makefile.ubsan          | 3 ++-
 scripts/integer-wrap-ignore.scl | 3 +++
 3 files changed, 6 insertions(+), 1 deletion(-)
 create mode 100644 scripts/integer-wrap-ignore.scl

lib/Kconfig.ubsan +1 -0

index 888c2e72c586..4216b3a4ff21 100644
@@ -125,6 +125,7 @@ config UBSAN_INTEGER_WRAP
 	depends on $(cc-option,-fsanitize=unsigned-integer-overflow)
 	depends on $(cc-option,-fsanitize=implicit-signed-integer-truncation)
 	depends on $(cc-option,-fsanitize=implicit-unsigned-integer-truncation)
+	depends on $(cc-option,-fsanitize-ignorelist=/dev/null)
 	help
 	  This option enables all of the sanitizers involved in integer overflow
 	  (wrap-around) mitigation: signed-integer-overflow, unsigned-integer-overflow,

scripts/Makefile.ubsan +2 -1

index 233379c193a7..9e35198edbf0 100644
@@ -19,5 +19,6 @@ ubsan-integer-wrap-cflags-$(CONFIG_UBSAN_INTEGER_WRAP)     +=	\
 	-fsanitize=signed-integer-overflow			\
 	-fsanitize=unsigned-integer-overflow			\
 	-fsanitize=implicit-signed-integer-truncation		\
-	-fsanitize=implicit-unsigned-integer-truncation
+	-fsanitize=implicit-unsigned-integer-truncation		\
+	-fsanitize-ignorelist=$(srctree)/scripts/integer-wrap-ignore.scl
 export CFLAGS_UBSAN_INTEGER_WRAP := $(ubsan-integer-wrap-cflags-y)

scripts/integer-wrap-ignore.scl new file +0 -0

new file mode 100644
index 000000000000..431c3053a4a2

Signature · 1 line

2.34.1