shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-06 02:50:49 +09:00
Code Issues Packages Projects Releases Wiki Activity

FROMLIST: ubsan: Split "bounds" checker from other options

Browse Source 
In order to do kernel builds with the bounds checker individually
available, introduce CONFIG_UBSAN_BOUNDS, with the remaining options
under CONFIG_UBSAN_MISC.

For example, using this, we can start to expand the coverage syzkaller is
providing. Right now, all of UBSan is disabled for syzbot builds because
taken as a whole, it is too noisy. This will let us focus on one feature
at a time.

For the bounds checker specifically, this provides a mechanism to
eliminate an entire class of array overflows with close to zero
performance overhead (I cannot measure a difference). In my (mostly)
defconfig, enabling bounds checking adds ~4200 checks to the kernel.
Performance changes are in the noise, likely due to the branch predictors
optimizing for the non-fail path.

Some notes on the bounds checker:

- it does not instrument {mem,str}*()-family functions, it only
  instruments direct indexed accesses (e.g. "foo[i]"). Dealing with
  the {mem,str}*()-family functions is a work-in-progress around
  CONFIG_FORTIFY_SOURCE[1].

- it ignores flexible array members, including the very old single
  byte (e.g. "int foo[1];") declarations. (Note that GCC's
  implementation appears to ignore _all_ trailing arrays, but Clang only
  ignores empty, 0, and 1 byte arrays[2].)

[1] https://github.com/KSPP/linux/issues/6
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92589

Bug: 136249967
Link: https://lore.kernel.org/kernel-hardening/20191121181519.28637-3-keescook@chromium.org/
Suggested-by: Elena Petrova <lenaptr@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Elena Petrova <lenaptr@google.com>
Change-Id: I1f79faea7386af1bc50faaf8b399ea6448611d5a
This commit is contained in:
Kees Cook
2019-11-19 17:06:35 -08:00
committed by Todd Kjos
parent 44a3813052
commit b93f1a29fa
2 changed files with 25 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
lib/Kconfig.ubsan
View File

@@ -22,6 +22,25 @@ config UBSAN_TRAP
can just issue a trap. This reduces the kernel size overhead but
turns all warnings into full thread-killing exceptions.
config UBSAN_BOUNDS
bool "Perform array bounds checking"
depends on UBSAN
default UBSAN
help
This option enables detection of direct out of bounds array
accesses, where the array size is known at compile time. Note
that this does not protect character array overflows due to
bad calls to the {str,mem}*cpy() family of functions.
config UBSAN_MISC
bool "Enable all other Undefined Behavior sanity checks"
depends on UBSAN
default UBSAN
help
This option enables all sanity checks that don't have their
own Kconfig options. Disable this if you only want to have
individually selected checks.
config UBSAN_SANITIZE_ALL
bool "Enable instrumentation for the entire kernel"
depends on UBSAN

7
scripts/Makefile.ubsan
View File

@@ -5,14 +5,19 @@ ifdef CONFIG_UBSAN_ALIGNMENT
CFLAGS_UBSAN += $(call cc-option, -fsanitize=alignment)
endif
ifdef CONFIG_UBSAN_BOUNDS
CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds)
endif
ifdef CONFIG_UBSAN_MISC
CFLAGS_UBSAN += $(call cc-option, -fsanitize=shift)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=integer-divide-by-zero)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=unreachable)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=signed-integer-overflow)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=bounds)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=object-size)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=bool)
CFLAGS_UBSAN += $(call cc-option, -fsanitize=enum)
endif
ifdef CONFIG_UBSAN_TRAP
CFLAGS_UBSAN += $(call cc-option, -fsanitize-undefined-trap-on-error)