Re: [PATCH 2/2] mm/usercopy: enable usercopy size checking for modern versions of gcc

[Kees Cook]

On Thu, Aug 25, 2016 at 4:47 PM, Josh Poimboeuf <jpoimboe@xxxxxxxxxx> wrote:
> On Tue, Aug 23, 2016 at 10:37:43PM -0400, Kees Cook wrote:
>> On Tue, Aug 23, 2016 at 3:28 PM, Josh Poimboeuf <jpoimboe@xxxxxxxxxx> wrote:
>> > This is a revert of:
>> >
>> >   2fb0815c9ee6 ("gcc4: disable __compiletime_object_size for GCC 4.6+")
>> >
>> > The goal of that commit was to silence the "provably correct" gcc
>> > warnings.  But it went too far: it also disabled the runtime warnings.
>> >
>> > Now that the pretty much useless gcc warnings have been properly
>> > disposed of with the previous patch, re-enable this checking on modern
>> > versions of gcc so we can get the runtime warnings again.
>>
>> As far as I know, this will still be broken since it's
>> __builtin_object_size() that is buggy. Maybe I'm misunderstanding
>> which piece is busted, though?
>
> What specifically is buggy with __builtin_object_size()?  Looking at the
> generated code for a few of the "provably correct" warning sites, the
> values generated by __builtin_object_size() are correct.
>
> I think the problem is really related to the compile-time warning
> function attribute used by __copy_to_user_overflow().  The warning is
> printed when gcc *can* determine the object size but it *can't*
> determine the copy size.  The warning just means that, even though the
> object has a const size, gcc isn't able to prove that the overflow won't
> happen.
>
> As an example, here's one of the warnings:
>
>   In file included from /home/jpoimboe/git/linux/include/linux/uaccess.h:5:0,
>                    from /home/jpoimboe/git/linux/arch/x86/include/asm/stacktrace.h:9,
>                    from /home/jpoimboe/git/linux/arch/x86/include/asm/perf_event.h:246,
>                    from /home/jpoimboe/git/linux/include/linux/perf_event.h:24,
>                    from /home/jpoimboe/git/linux/kernel/sys.c:16:
>   In function âcopy_to_user.part.10â,
>       inlined from âcopy_to_userâ,
>       inlined from âoverride_release.part.11â at /home/jpoimboe/git/linux/kernel/sys.c:1136:9:
>   /home/jpoimboe/git/linux/arch/x86/include/asm/uaccess.h:723:46: warning: call to â__copy_to_user_overflowâ declared with attribute warning: copy_to_user() buffer size is not provably correct
>    #define __copy_to_user_overflow(size, count) __copy_to_user_overflow()
>                                                 ^~~~~~~~~~~~~~~~~~~~~~~~~
>   /home/jpoimboe/git/linux/arch/x86/include/asm/uaccess.h:791:3: note: in expansion of macro â__copy_to_user_overflowâ
>      __copy_to_user_overflow(sz, n);
>      ^~~~~~~~~~~~~~~~~~~~~~~
>
> This is from override_release()'s use of copy_to_user().  The object
> code shows that __builtin_object_size() correctly reports 65 bytes for
> the 'buf' object size.  But the copy size ('copy + 1') isn't known at
> compile-time.  Thus the (bogus) warning.
>
> Maybe I'm missing something but I don't even see a gcc bug.  To me it
> looks like a mismatch in expectations between the code and the compiler.

Ah, yes, I had a total brain failure. This is what I get trying to do
email between sessions at a conference. :)

Okay, right. __builtin_object_size() is totally fine, I absolutely
misspoke: it's the resolution of const value ranges. I wouldn't expect
gcc to warn here, though, since "copy + 1" isn't a const value...

-Kees

-- 
Kees Cook
Nexus Security