Commit d0858cbd authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'overflow-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux 

Pull overflow updates from Kees Cook:
 "These changes come in roughly two halves: support of Gustavo A. R.
  Silva's struct_size() work via additional helpers for catching
  overflow allocation size calculations, and conversions of selftests to
  KUnit (which includes some tweaks for UML + Clang):

   - Convert overflow selftest to KUnit

   - Convert stackinit selftest to KUnit

   - Implement size_t saturating arithmetic helpers

   - Allow struct_size() to be used in initializers"

* tag 'overflow-v5.18-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  lib: stackinit: Convert to KUnit
  um: Allow builds with Clang
  lib: overflow: Convert to Kunit
  overflow: Provide constant expression struct_size
  overflow: Implement size_t saturating arithmetic helpers
  test_overflow: Regularize test reporting output
parents 2142b7f0 02788ebc

Documentation/process/deprecated.rst

+17 −3
Original line number Diff line number Diff line
@@ -71,6 +71,9 @@ Instead, the 2-factor form of the allocator should be used:: 


	foo = kmalloc_array(count, size, GFP_KERNEL);



Specifically, kmalloc() can be replaced with kmalloc_array(), and

kzalloc() can be replaced with kcalloc().



If no 2-factor form is available, the saturate-on-overflow helpers should

be used::
@@ -91,9 +94,20 @@ Instead, use the helper:: 
        array usage and switch to a `flexible array member

        <#zero-length-and-one-element-arrays>`_ instead.



See array_size(), array3_size(), and struct_size(),

for more details as well as the related check_add_overflow() and

check_mul_overflow() family of functions.

For other calculations, please compose the use of the size_mul(),

size_add(), and size_sub() helpers. For example, in the case of::



	foo = krealloc(current_size + chunk_size * (count - 3), GFP_KERNEL);



Instead, use the helpers::



	foo = krealloc(size_add(current_size,

				size_mul(chunk_size,

					 size_sub(count, 3))), GFP_KERNEL);



For more details, also see array3_size() and flex_array_size(),

as well as the related check_mul_overflow(), check_add_overflow(),

check_sub_overflow(), and check_shl_overflow() family of functions.



simple_strtol(), simple_strtoll(), simple_strtoul(), simple_strtoull()

----------------------------------------------------------------------

arch/um/os-Linux/execvp.c

+1 −0
Original line number Diff line number Diff line
@@ -93,6 +93,7 @@ int execvp_noalloc(char *buf, const char *file, char *const argv[]) 
					   up finding no executable we can use, we want to diagnose

					   that we did find one but were denied access.  */

					got_eacces = 1;

					break;

				case ENOENT:

				case ESTALE:

				case ENOTDIR:

arch/x86/um/user-offsets.c

+4 −5
Original line number Diff line number Diff line
@@ -8,12 +8,11 @@ 
#define __FRAME_OFFSETS

#include <linux/ptrace.h>

#include <asm/types.h>



#define DEFINE(sym, val) \

	asm volatile("\n->" #sym " %0 " #val : : "i" (val))

#include <linux/kbuild.h>



#define DEFINE_LONGS(sym, val)	\

	asm volatile("\n->" #sym " %0 " #val : : "i" (val/sizeof(unsigned long)))

	COMMENT(#val " / sizeof(unsigned long)");	\

	DEFINE(sym, val / sizeof(unsigned long))



void foo(void)

{

include/linux/overflow.h

+73 −41
Original line number Diff line number Diff line
@@ -4,6 +4,7 @@ 


#include <linux/compiler.h>

#include <linux/limits.h>

#include <linux/const.h>



/*

 * We need to compute the minimum and maximum values representable in a given
@@ -118,81 +119,94 @@ static inline bool __must_check __must_check_overflow(bool overflow) 
}))



/**

 * array_size() - Calculate size of 2-dimensional array.

 *

 * @a: dimension one

 * @b: dimension two

 * size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX

 *

 * Calculates size of 2-dimensional array: @a * @b.

 * @factor1: first factor

 * @factor2: second factor

 *

 * Returns: number of bytes needed to represent the array or SIZE_MAX on

 * overflow.

 * Returns: calculate @factor1 * @factor2, both promoted to size_t,

 * with any overflow causing the return value to be SIZE_MAX. The

 * lvalue must be size_t to avoid implicit type conversion.

 */

static inline __must_check size_t array_size(size_t a, size_t b)

static inline size_t __must_check size_mul(size_t factor1, size_t factor2)

{

	size_t bytes;



	if (check_mul_overflow(a, b, &bytes))

	if (check_mul_overflow(factor1, factor2, &bytes))

		return SIZE_MAX;



	return bytes;

}



/**

 * array3_size() - Calculate size of 3-dimensional array.

 * size_add() - Calculate size_t addition with saturation at SIZE_MAX

 *

 * @a: dimension one

 * @b: dimension two

 * @c: dimension three

 *

 * Calculates size of 3-dimensional array: @a * @b * @c.

 * @addend1: first addend

 * @addend2: second addend

 *

 * Returns: number of bytes needed to represent the array or SIZE_MAX on

 * overflow.

 * Returns: calculate @addend1 + @addend2, both promoted to size_t,

 * with any overflow causing the return value to be SIZE_MAX. The

 * lvalue must be size_t to avoid implicit type conversion.

 */

static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)

static inline size_t __must_check size_add(size_t addend1, size_t addend2)

{

	size_t bytes;



	if (check_mul_overflow(a, b, &bytes))

		return SIZE_MAX;

	if (check_mul_overflow(bytes, c, &bytes))

	if (check_add_overflow(addend1, addend2, &bytes))

		return SIZE_MAX;



	return bytes;

}



/*

 * Compute a*b+c, returning SIZE_MAX on overflow. Internal helper for

 * struct_size() below.

/**

 * size_sub() - Calculate size_t subtraction with saturation at SIZE_MAX

 *

 * @minuend: value to subtract from

 * @subtrahend: value to subtract from @minuend

 *

 * Returns: calculate @minuend - @subtrahend, both promoted to size_t,

 * with any overflow causing the return value to be SIZE_MAX. For

 * composition with the size_add() and size_mul() helpers, neither

 * argument may be SIZE_MAX (or the result with be forced to SIZE_MAX).

 * The lvalue must be size_t to avoid implicit type conversion.

 */

static inline __must_check size_t __ab_c_size(size_t a, size_t b, size_t c)

static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)

{

	size_t bytes;



	if (check_mul_overflow(a, b, &bytes))

		return SIZE_MAX;

	if (check_add_overflow(bytes, c, &bytes))

	if (minuend == SIZE_MAX || subtrahend == SIZE_MAX ||

	    check_sub_overflow(minuend, subtrahend, &bytes))

		return SIZE_MAX;



	return bytes;

}



/**

 * struct_size() - Calculate size of structure with trailing array.

 * @p: Pointer to the structure.

 * @member: Name of the array member.

 * @count: Number of elements in the array.

 * array_size() - Calculate size of 2-dimensional array.

 *

 * Calculates size of memory needed for structure @p followed by an

 * array of @count number of @member elements.

 * @a: dimension one

 * @b: dimension two

 *

 * Return: number of bytes needed or SIZE_MAX on overflow.

 * Calculates size of 2-dimensional array: @a * @b.

 *

 * Returns: number of bytes needed to represent the array or SIZE_MAX on

 * overflow.

 */

#define struct_size(p, member, count)					\

	__ab_c_size(count,						\

		    sizeof(*(p)->member) + __must_be_array((p)->member),\

		    sizeof(*(p)))

#define array_size(a, b)	size_mul(a, b)



/**

 * array3_size() - Calculate size of 3-dimensional array.

 *

 * @a: dimension one

 * @b: dimension two

 * @c: dimension three

 *

 * Calculates size of 3-dimensional array: @a * @b * @c.

 *

 * Returns: number of bytes needed to represent the array or SIZE_MAX on

 * overflow.

 */

#define array3_size(a, b, c)	size_mul(size_mul(a, b), c)



/**

 * flex_array_size() - Calculate size of a flexible array member
@@ -208,7 +222,25 @@ static inline __must_check size_t __ab_c_size(size_t a, size_t b, size_t c) 
 * Return: number of bytes needed or SIZE_MAX on overflow.

 */

#define flex_array_size(p, member, count)				\

	array_size(count,						\

		    sizeof(*(p)->member) + __must_be_array((p)->member))

	__builtin_choose_expr(__is_constexpr(count),			\

		(count) * sizeof(*(p)->member) + __must_be_array((p)->member),	\

		size_mul(count, sizeof(*(p)->member) + __must_be_array((p)->member)))



/**

 * struct_size() - Calculate size of structure with trailing flexible array.

 *

 * @p: Pointer to the structure.

 * @member: Name of the array member.

 * @count: Number of elements in the array.

 *

 * Calculates size of memory needed for structure @p followed by an

 * array of @count number of @member elements.

 *

 * Return: number of bytes needed or SIZE_MAX on overflow.

 */

#define struct_size(p, member, count)					\

	__builtin_choose_expr(__is_constexpr(count),			\

		sizeof(*(p)) + flex_array_size(p, member, count),	\

		size_add(sizeof(*(p)), flex_array_size(p, member, count)))



#endif /* __LINUX_OVERFLOW_H */

lib/Kconfig.debug

+24 −14
Original line number Diff line number Diff line
@@ -2214,9 +2214,6 @@ config TEST_UUID 
config TEST_XARRAY

	tristate "Test the XArray code at runtime"



config TEST_OVERFLOW

	tristate "Test check_*_overflow() functions at runtime"



config TEST_RHASHTABLE

	tristate "Perform selftest on resizable hash table"

	help
@@ -2501,6 +2498,30 @@ config MEMCPY_KUNIT_TEST 


	  If unsure, say N.



config OVERFLOW_KUNIT_TEST

	tristate "Test check_*_overflow() functions at runtime" if !KUNIT_ALL_TESTS

	depends on KUNIT

	default KUNIT_ALL_TESTS

	help

	  Builds unit tests for the check_*_overflow(), size_*(), allocation, and

	  related functions.



	  For more information on KUnit and unit tests in general please refer

	  to the KUnit documentation in Documentation/dev-tools/kunit/.



	  If unsure, say N.



config STACKINIT_KUNIT_TEST

	tristate "Test level of stack variable initialization" if !KUNIT_ALL_TESTS

	depends on KUNIT

	default KUNIT_ALL_TESTS

	help

	  Test if the kernel is zero-initializing stack variables and

	  padding. Coverage is controlled by compiler flags,

	  CONFIG_INIT_STACK_ALL_PATTERN, CONFIG_INIT_STACK_ALL_ZERO,

	  CONFIG_GCC_PLUGIN_STRUCTLEAK, CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF,

	  or CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL.



config TEST_UDELAY

	tristate "udelay test driver"

	help
@@ -2592,17 +2613,6 @@ config TEST_OBJAGG 
	  Enable this option to test object aggregation manager on boot

	  (or module load).





config TEST_STACKINIT

	tristate "Test level of stack variable initialization"

	help

	  Test if the kernel is zero-initializing stack variables and

	  padding. Coverage is controlled by compiler flags,

	  CONFIG_GCC_PLUGIN_STRUCTLEAK, CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF,

	  or CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL.



	  If unsure, say N.



config TEST_MEMINIT

	tristate "Test heap/page initialization"

	help