Files
linux/include/linux
Rasmus Villemoes 1777fa9611 compiler.h: enable builtin overflow checkers and add fallback code
commit f0907827a8 upstream.

This adds wrappers for the __builtin overflow checkers present in gcc
5.1+ as well as fallback implementations for earlier compilers. It's not
that easy to implement the fully generic __builtin_X_overflow(T1 a, T2
b, T3 *d) in macros, so the fallback code assumes that T1, T2 and T3 are
the same. We obviously don't want the wrappers to have different
semantics depending on $GCC_VERSION, so we also insist on that even when
using the builtins.

There are a few problems with the 'a+b < a' idiom for checking for
overflow: For signed types, it relies on undefined behaviour and is
not actually complete (it doesn't check underflow;
e.g. INT_MIN+INT_MIN == 0 isn't caught). Due to type promotion it
is wrong for all types (signed and unsigned) narrower than
int. Similarly, when a and b does not have the same type, there are
subtle cases like

  u32 a;

  if (a + sizeof(foo) < a)
    return -EOVERFLOW;
  a += sizeof(foo);

where the test is always false on 64 bit platforms. Add to that that it
is not always possible to determine the types involved at a glance.

The new overflow.h is somewhat bulky, but that's mostly a result of
trying to be type-generic, complete (e.g. catching not only overflow
but also signed underflow) and not relying on undefined behaviour.

Linus is of course right [1] that for unsigned subtraction a-b, the
right way to check for overflow (underflow) is "b > a" and not
"__builtin_sub_overflow(a, b, &d)", but that's just one out of six cases
covered here, and included mostly for completeness.

So is it worth it? I think it is, if nothing else for the documentation
value of seeing

  if (check_add_overflow(a, b, &d))
    return -EGOAWAY;
  do_stuff_with(d);

instead of the open-coded (and possibly wrong and/or incomplete and/or
UBsan-tickling)

  if (a+b < a)
    return -EGOAWAY;
  do_stuff_with(a+b);

While gcc does recognize the 'a+b < a' idiom for testing unsigned add
overflow, it doesn't do nearly as good for unsigned multiplication
(there's also no single well-established idiom). So using
check_mul_overflow in kcalloc and friends may also make gcc generate
slightly better code.

[1] https://lkml.org/lkml/2015/11/2/658

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-01-31 08:12:35 +01:00
..
2015-10-07 18:08:15 +01:00
2016-07-08 16:23:11 +02:00
2016-08-25 11:26:48 -04:00
2017-10-08 10:26:06 +02:00
2018-04-24 09:34:18 +02:00
2016-09-14 09:18:06 -06:00
2016-06-07 13:41:38 -06:00
2016-08-11 09:41:35 -06:00
2017-06-14 15:06:00 +02:00
2018-02-28 10:18:33 +01:00
2017-07-15 12:16:11 +02:00
2016-06-07 13:41:38 -06:00
2016-05-17 15:48:12 -04:00
2017-05-14 14:00:22 +02:00
2017-07-12 15:01:02 +02:00
2017-08-06 18:59:43 -07:00
2018-04-24 09:34:12 +02:00
2016-07-22 09:07:02 +02:00
2016-09-24 10:48:18 +02:00
2015-05-05 13:40:42 -06:00
2015-11-25 09:22:00 -07:00
2016-02-11 09:59:22 -05:00
2016-10-20 15:51:28 +11:00
2016-09-16 09:34:15 +01:00
2016-09-14 09:18:09 -06:00
2016-05-11 22:37:54 +02:00
2015-06-25 12:06:45 +02:00
2016-01-28 14:19:12 -08:00
2018-10-10 08:53:18 +02:00
2016-03-22 15:36:02 -07:00
2016-08-10 11:23:44 -04:00
2016-03-22 15:36:02 -07:00
2015-07-28 08:50:42 +01:00
2016-01-15 17:56:32 -08:00
2016-09-15 16:49:39 +02:00
2015-04-29 17:17:17 -05:00
2016-09-14 12:57:43 -07:00
2016-09-27 12:33:47 +02:00
2017-08-24 17:12:19 -07:00
2015-06-24 17:49:41 -07:00
2015-07-21 10:39:05 -07:00
2016-07-29 12:17:52 -07:00
2016-08-28 23:32:41 -04:00
2016-06-03 19:37:21 -04:00
2016-04-25 15:09:11 -04:00
2016-02-16 13:04:58 -05:00
2016-10-19 11:36:22 -06:00
2016-05-02 09:00:56 -05:00
2018-09-09 20:01:20 +02:00
2015-04-12 21:03:31 +02:00
2016-02-11 18:35:48 -08:00
2016-03-14 15:43:11 -04:00
2017-08-24 17:12:21 -07:00
2016-10-14 11:36:59 -07:00
2016-07-12 19:25:38 -07:00
2016-09-27 21:52:00 -04:00
2016-09-08 15:01:10 -07:00
2016-03-17 15:09:34 -07:00
2016-07-06 10:51:14 +01:00
2016-03-22 15:36:02 -07:00
2016-07-26 16:19:19 -07:00
2016-09-08 22:15:25 -07:00
2017-08-30 10:21:40 +02:00
2019-01-31 08:12:33 +01:00
2016-08-28 23:44:55 -04:00
2016-05-08 23:46:14 -04:00
2016-10-05 18:23:36 -04:00
2017-01-19 20:17:59 +01:00
2015-06-25 17:00:39 -07:00
2018-11-13 11:17:02 -08:00
2016-06-20 12:47:15 -07:00
2015-10-01 09:57:59 -07:00
2016-07-19 17:43:38 +03:00
2016-05-23 17:04:14 -07:00
2018-11-27 16:09:41 +01:00
2016-04-07 16:53:29 -04:00
2017-04-21 09:31:21 +02:00
2015-11-23 09:44:58 +01:00
2016-07-26 16:19:19 -07:00
2016-05-20 17:58:30 -07:00
2017-12-25 14:23:37 +01:00
2016-06-25 09:04:48 -07:00
2016-09-30 10:54:03 +02:00
2015-12-03 07:24:29 -08:00
2018-12-05 19:42:42 +01:00
2015-09-08 15:35:28 -07:00