Daniel Micay
0f51310ad5
include/linux/string.h: add the option of fortified string.h functions ...
This adds support for compiling with a rough equivalent to the glibc
_FORTIFY_SOURCE=1 feature, providing compile-time and runtime buffer
overflow checks for string.h functions when the compiler determines the
size of the source or destination buffer at compile-time. Unlike glibc,
it covers buffer reads in addition to writes.
GNU C __builtin_*_chk intrinsics are avoided because they would force a
much more complex implementation. They aren't designed to detect read
overflows and offer no real benefit when using an implementation based
on inline checks. Inline checks don't add up to much code size and
allow full use of the regular string intrinsics while avoiding the need
for a bunch of _chk functions and per-arch assembly to avoid wrapper
overhead.
This detects various overflows at compile-time in various drivers and
some non-x86 core kernel code. There will likely be issues caught in
regular use at runtime too.
Future improvements left out of initial implementation for simplicity,
as it's all quite optional and can be done incrementally:
* Some of the fortified string functions (strncpy, strcat), don't yet
place a limit on reads from the source based on __builtin_object_size of
the source buffer.
* Extending coverage to more string functions like strlcat.
* It should be possible to optionally use __builtin_object_size(x, 1) for
some functions (C strings) to detect intra-object overflows (like
glibc's _FORTIFY_SOURCE=2), but for now this takes the conservative
approach to avoid likely compatibility issues.
* The compile-time checks should be made available via a separate config
option which can be enabled by default (or always enabled) once enough
time has passed to get the issues it catches fixed.
Kees said:
"This is great to have. While it was out-of-tree code, it would have
blocked at least CVE-2016-3858 from being exploitable (improper size
argument to strlcpy()). I've sent a number of fixes for
out-of-bounds-reads that this detected upstream already"
Change-Id: I4c6ba947ffc296caf1b074f7ef4a3b64877230ea
[arnd@arndb.de: x86: fix fortified memcpy]
Link: http://lkml.kernel.org/r/20170627150047.660360-1-arnd@arndb.de
[keescook@chromium.org: avoid panic() in favor of BUG()]
Link: http://lkml.kernel.org/r/20170626235122.GA25261@beast
[keescook@chromium.org: move from -mm, add ARCH_HAS_FORTIFY_SOURCE, tweak Kconfig help]
Link: http://lkml.kernel.org/r/20170526095404.20439-1-danielmicay@gmail.com
Link: http://lkml.kernel.org/r/1497903987-21002-8-git-send-email-keescook@chromium.org
Signed-off-by: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Kees Cook <keescook@chromium.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Daniel Axtens <dja@axtens.net>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 6974f0c4555e285ab217cee58b6e874f776ff409
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Olav Haugan <ohaugan@codeaurora.org>
2017-08-07 17:43:55 -07:00
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial
2016-03-17 21:38:27 -07:00
fonts: Add 6x10 font
2014-10-09 11:35:48 +03:00
lib: lz4: cleanup unaligned access efficiency detection
2016-04-13 09:22:49 -07:00
lzo: check for length overrun in variable length encoding.
2014-09-28 11:08:01 +02:00
mpi: Fix NULL ptr dereference in mpi_powm() [ver #3 ]
2016-11-25 12:57:50 +11:00
Merge tag 'md/4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md
2016-10-07 09:45:43 -07:00
lib/xz: enable all filters by default in Kconfig
2014-06-04 16:54:18 -07:00
zlib_deflate/deftree: remove bi_reverse()
2015-09-10 13:29:01 -07:00
zlib: clean up some dead code
2014-08-06 18:01:24 -07:00
Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
2016-05-17 09:33:39 -07:00
assoc_array: don't call compare_object() on a node
2016-04-06 14:06:48 +01:00
locking/atomic: Implement atomic{,64,_long}_fetch_{add,sub,and,andnot,or,xor}{,_relaxed,_acquire,_release}()
2016-06-16 10:48:32 +02:00
atomic64: no need for CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
2016-10-07 18:46:30 -07:00
syscalls: implement execveat() system call
2014-12-13 12:42:51 -08:00
lib/bitmap.c: enhance bitmap syntax
2016-10-11 15:06:30 -07:00
ARM: 8187/1: add CONFIG_HAVE_ARCH_BITREVERSE to support rbit instruction
2014-12-22 16:43:06 +00:00
treewide: Remove old email address
2015-11-23 09:44:58 +01:00
lib/bug.c: use common WARN helper
2016-03-17 15:09:34 -07:00
random: replace non-blocking pool with a Chacha20-based CRNG
2016-07-03 00:57:23 -04:00
ipv4: Update parameters for csum_tcpudp_magic to their original types
2016-03-13 23:55:13 -04:00
lib/clz_ctz.c: add prototype declarations in lib/clz_ctz.c
2014-04-03 16:21:12 -07:00
lib/cmdline.c: fix get_options() overflow while parsing ranges
2017-06-29 13:00:28 +02:00
audit: Add generic compat syscall support
2014-03-20 10:11:35 -04:00
fault-injection/cpu: Convert to hotplug state machine
2016-09-19 21:44:31 +02:00
sched/topology: Rename topology_thread_cpumask() to topology_sibling_cpumask()
2015-05-27 15:22:15 +02:00
sched/fair, cpumask: Export for_each_cpu_wrap()
2017-07-21 07:42:23 +02:00
lib: crc-itu-t.[ch] fix 0x0x prefix in integer constants
2015-05-26 15:26:43 +02:00
lib: introduce crc_t10dif_update()
2015-05-30 22:42:24 -07:00
lib/crc7: Shift crc7() output left 1 bit
2014-05-16 14:26:52 -04:00
crc32: use ktime_get_ns() for measurement
2016-08-02 19:35:08 -04:00
kbuild: include core debug info when DEBUG_INFO_REDUCED
2015-06-11 15:08:32 +02:00
lib/debugobjects: export for use in modules
2016-11-30 16:32:52 -08:00
lib/decompress: set the compressor name to NULL on error
2015-07-17 16:39:54 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompress_unlzma: Do a NULL check for pointer
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
lib/decompressors: use real out buf size for gunzip with kernel
2015-09-10 13:29:01 -07:00
devres: use to_pci_dev()
2016-02-07 23:17:59 -08:00
lib/digsig: digsig_verify_rsa(): return -EINVAL if modulo length is zero
2016-05-31 16:42:00 +08:00
__div64_32(): make it overridable at compile time
2015-11-16 14:42:12 -05:00
dmaengine updates for 4.8-rc1
2016-10-06 17:13:54 -07:00
dma-mapping: use unsigned long for dma_attrs
2016-08-04 08:50:07 -04:00
dump_stack: avoid potential deadlocks
2016-02-05 18:10:40 -08:00
dynamic_debug: add jump label support
2016-08-04 08:50:07 -04:00
lib/dynamic_queue_limits.c: simplify includes
2015-02-12 18:54:15 -08:00
lib/cpio: Make find_cpio_data()'s offset arg optional
2016-06-08 11:04:19 +02:00
extable: add support for relative extables to search and sort routines
2016-02-24 14:57:26 +00:00
fault-inject: fix inverted interval/probability values in printk
2015-10-23 17:55:10 +09:00
lib: add fdt_empty_tree.c
2014-04-30 19:49:37 +01:00
lib: rename lib/find_next_bit.c to lib/find_bit.c
2015-04-17 09:03:54 -04:00
reciprocal_divide: update/correction of the algorithm
2014-01-21 23:17:20 -08:00
lib+mm: fix few spelling mistakes
2016-02-15 11:18:23 +01:00
lib/GCD.c: use binary GCD algorithm instead of Euclidean
2016-05-20 17:58:30 -07:00
lib: crc32: constify crc32 lookup table
2015-02-13 21:21:35 -08:00
lib/genalloc.c: start search from start of chunk
2016-10-27 18:43:43 -07:00
lib/glob.c: add CONFIG_GLOB_SELFTEST
2014-08-06 18:01:25 -07:00
lib/halfmd4.c: use rol32 inline function in the ROUND macro
2015-11-06 17:50:42 -08:00
lib/hexdump.c: truncate output in case of overflow
2015-11-06 17:50:42 -08:00
x86/hweight: Get rid of the special calling convention
2016-06-08 15:01:02 +02:00
mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd
2015-11-06 17:50:42 -08:00
lib/interval_tree.c: simplify includes
2015-02-12 18:54:15 -08:00
lib: Export interval_tree
2014-05-05 09:09:14 +02:00
lib: iomap: Add MSM RTB support
2016-09-26 15:03:43 -07:00
lib/iomap_copy.c: add __ioread32_copy()
2016-01-20 17:09:18 -08:00
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc
2015-11-05 16:34:48 -08:00
lib/iommu-helper: skip to next segment
2016-08-02 19:35:07 -04:00
x86, mm: support huge KVA mappings on x86
2015-04-14 16:49:04 -07:00
new privimitive: iov_iter_revert()
2017-04-21 09:31:21 +02:00
This adds a new gcc plugin named "latent_entropy". It is designed to
2016-10-15 10:03:15 -07:00
lib/is_single_threaded.c: change current_is_single_threaded() to use for_each_thread()
2015-11-06 17:50:42 -08:00
lib/kasprintf.c: add sanity check to kvasprintf
2016-01-16 11:17:27 -08:00
soc: qcom: Add snapshot of QMI
2016-11-11 17:31:37 -08:00
Merge remote-tracking branch '4.9/tmp-75d78c7' into 4.9
2017-07-05 13:17:33 -07:00
mm, kasan: switch SLUB to stackdepot, enable memory quarantine for SLUB
2016-07-28 16:07:41 -07:00
kgdb: depends on VT
2016-05-23 17:04:14 -07:00
ubsan: allow to disable the null sanitizer
2016-09-20 14:26:08 +02:00
kfifo: use BUG_ON
2014-08-08 15:57:25 -07:00
klist: fix starting point removed bug in klist iterators
2016-02-07 22:18:47 -08:00
kobject: export kset_find_obj() for module use
2016-02-09 17:36:34 -08:00
lib/kobject_uevent.c: remove redundant include
2015-02-12 18:54:15 -08:00
lib/kstrtox.c: smaller _parse_integer()
2016-10-11 15:06:30 -07:00
block: fix blk_stack_limits() regression due to lcm() change
2015-03-31 09:45:50 -06:00
crypto: Work around deallocated stack frame reference gcc bug on sparc.
2017-06-24 07:11:17 +02:00
kernel/lib: add additional debug capabilities for data corruption
2017-03-29 13:02:14 -07:00
lib/list_sort: use late_initcall to hook in self tests
2015-06-16 14:12:35 -04:00
lib/llist.c: fix data race in llist_del_first
2015-11-06 17:50:42 -08:00
locking/selftest: Fix output since KERN_CONT changes
2016-11-25 07:12:19 +01:00
locking/lockref: Remove homebrew cmpxchg64_relaxed() macro definition
2015-08-12 11:59:04 +02:00
lru_cache: Converted lc_seq_printf_status to return void
2015-11-25 09:22:02 -07:00
lib: Ignore kasan errors from find_next_bit and last bit
2017-03-29 12:50:42 -07:00
lib/md5.c: simplify include
2015-02-12 18:54:15 -08:00
mac_pton: Use bool not int return
2014-06-25 17:45:43 -07:00
net: Add support for CHANGEUPPER notifier error injection
2015-12-03 11:49:23 -05:00
libnl: fix help of _64bit functions
2016-04-23 20:13:24 -04:00
nmi_backtrace: generate one-line reports for idle cpus
2016-10-07 18:46:30 -07:00
include/linux/nodemask.h: create next_node_in() helper
2016-05-19 19:12:14 -07:00
once: make helper generic for calling functions once
2015-10-08 05:26:36 -07:00
lib/parser.c: put EXPORT_SYMBOLs in the conventional place
2014-01-23 16:36:55 -08:00
libnvdimm for 4.3:
2015-09-08 14:35:59 -07:00
percpu-refcount: init ->confirm_switch member properly
2016-08-11 13:52:23 -04:00
percpu_counter: update debugobjects fixup callbacks return type
2016-05-19 19:12:14 -07:00
mm, page_alloc: rename __GFP_WAIT to __GFP_RECLAIM
2015-11-06 17:50:42 -08:00
lib/plist.c: remove redundant include
2015-02-12 18:54:16 -08:00
soc: qcom: Add snapshot of QMI
2016-11-11 17:31:37 -08:00
soc: qcom: Add snapshot of QMI
2016-11-11 17:31:37 -08:00
Revert "radix tree test suite: fix compilation"
2016-12-09 10:41:42 -08:00
This adds a new gcc plugin named "latent_entropy". It is designed to
2016-10-15 10:03:15 -07:00
ratelimit: extend to print suppressed messages on release
2016-08-02 19:35:06 -04:00
Introduce rb_replace_node_rcu()
2016-07-06 10:51:14 +01:00
rbtree/test: test rbtree_postorder_for_each_entry_safe()
2014-01-23 16:37:03 -08:00
reciprocal_divide: update/correction of the algorithm
2014-01-21 23:17:20 -08:00
rhashtable: Add rhlist interface
2016-09-20 04:43:36 -04:00
sbitmap: initialize weight to zero
2016-09-19 08:19:40 -06:00
scatterlist: fix a typo in comment block of sg_miter_stop()
2016-02-08 10:15:17 -08:00
tracing: Use seq_buf_used() in seq_buf_to_user() instead of len
2015-12-23 14:27:20 -05:00
lib: scatterlist: move SG pool code from SCSI driver to lib/sg_pool.c
2016-04-15 16:53:14 -04:00
lib: scatterlist: add sg splitting function
2015-08-24 14:28:01 -06:00
lib: EXPORT_SYMBOL sha_init
2015-03-23 22:12:08 -04:00
lib/show_mem.c: correct reserved memory calculation
2015-09-08 15:35:28 -07:00
percpu: add preemption checks to __this_cpu ops
2014-04-07 16:36:14 -07:00
lib/sort: Add 64 bit swap function
2015-06-25 17:00:40 -07:00
lib/stackdepot: export save/fetch stack for drivers
2016-11-11 08:12:37 -08:00
lib/stmp_device.c: replace module.h include
2015-02-12 18:54:16 -08:00
include/linux/string.h: add the option of fortified string.h functions
2017-08-07 17:43:55 -07:00
string_helpers: add kstrdup_quotable_file
2016-04-21 10:47:26 +10:00
lib: harden strncpy_from_user
2016-10-11 15:06:30 -07:00
unsafe_[get|put]_user: change interface to use a error target label
2016-08-08 13:02:01 -07:00
swiotlb: ensure that page-sized mappings are page-aligned
2017-07-05 14:40:26 +02:00
lib/syscall: Clear return values when no stack
2017-04-08 09:30:35 +02:00
kstrto*: accept "-0" for signed conversion
2015-09-10 13:29:01 -07:00
lib/test-string_helpers.c: fix and improve string_get_size() tests
2016-02-03 08:28:43 -08:00
test_bitmap: unit tests for lib/bitmap.c
2016-02-19 22:54:09 -05:00
bpf, arm64: fix jit branch offset related to ldimm64
2017-05-14 14:00:21 +02:00
test: firmware_class: add asynchronous request trigger
2016-01-07 13:44:22 -07:00
lib/test_hash.c: fix warning in preprocessor symbol evaluation
2016-09-01 17:52:01 -07:00
test_hexdump: print statistics at the end
2016-01-20 17:09:18 -08:00
kasan: support use-after-scope detection
2016-11-30 16:32:52 -08:00
test: add minimal module for verification testing
2014-01-23 16:36:57 -08:00
mm, printk: introduce new format string for flags
2016-03-15 16:55:16 -07:00
rhashtable-test: Fix max_size parameter description
2016-08-08 12:52:42 -07:00
locking/static_keys: Provide a selftest
2015-08-03 11:51:12 +02:00
locking/static_keys: Avoid nested functions
2016-02-09 10:27:29 +01:00
usercopy: Adjust tests to deal with SMAP/PAN
2017-06-14 15:06:05 +02:00
lib/uuid: add a test module
2016-05-30 15:26:57 -07:00
lib/textsearch.c: remove textsearch_put reference from comments
2014-10-14 02:18:14 +02:00
timerqueue: Let timerqueue_add/del return information
2015-04-22 17:06:49 +02:00
UBSAN: fix typo in format string
2016-08-02 17:31:41 -04:00
UBSAN: run-time undefined behavior sanity checker
2016-01-20 17:09:18 -08:00
lib/ucs2_string: Speed up ucs2_utf8size()
2016-09-09 16:08:46 +01:00
lib/uuid.c: use correct offset in uuid parser
2016-05-30 15:26:57 -07:00
lib/uuid.c: introduce a few more generic helpers
2016-05-20 17:58:30 -07:00
lib/win_minmax: windowed min or max estimator
2016-09-21 00:22:59 -04:00
0f51310ad5