TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

overflow: Implement size_t saturating arithmetic helpers

Browse Source 
commit e1be43d9b5d0d1310dbd90185a8e5c7145dde40f upstream.

In order to perform more open-coded replacements of common allocation
size arithmetic, the kernel needs saturating (SIZE_MAX) helpers for
multiplication, addition, and subtraction. For example, it is common in
allocators, especially on realloc, to add to an existing size:

    p = krealloc(map->patch,
                 sizeof(struct reg_sequence) * (map->patch_regs + num_regs),
                 GFP_KERNEL);

There is no existing saturating replacement for this calculation, and
just leaving the addition open coded inside array_size() could
potentially overflow as well. For example, an overflow in an expression
for a size_t argument might wrap to zero:

    array_size(anything, something_at_size_max + 1) == 0

Introduce size_mul(), size_add(), and size_sub() helpers that
implicitly promote arguments to size_t and saturated calculations for
use in allocations. With these helpers it is also possible to redefine
array_size(), array3_size(), flex_array_size(), and struct_size() in
terms of the new helpers.

As with the check_*_overflow() helpers, the new helpers use __must_check,
though what is really desired is a way to make sure that assignment is
only to a size_t lvalue. Without this, it's still possible to introduce
overflow/underflow via type conversion (i.e. from size_t to int).
Enforcing this will currently need to be left to static analysis or
future use of -Wconversion.

Additionally update the overflow unit tests to force runtime evaluation
for the pathological cases.

Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Keith Busch <kbusch@kernel.org>
Cc: Len Baker <len.baker@gmx.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Kees Cook
2021-09-18 15:17:53 -07:00
committed by Greg Kroah-Hartman
parent 81bec94f5d
commit 1f5cbd7817
2 changed files with 180 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files

132
include/linux/overflow.h
View File

@@ -240,6 +240,69 @@
(*_d >> _to_shift) != _a); \
})
/**
* size_mul() - Calculate size_t multiplication with saturation at SIZE_MAX
*
* @factor1: first factor
* @factor2: second factor
*
* Returns: calculate @factor1 * @factor2, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. The
* lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_mul(size_t factor1, size_t factor2)
{
size_t bytes;
if (check_mul_overflow(factor1, factor2, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* size_add() - Calculate size_t addition with saturation at SIZE_MAX
*
* @addend1: first addend
* @addend2: second addend
*
* Returns: calculate @addend1 + @addend2, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. The
* lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_add(size_t addend1, size_t addend2)
{
size_t bytes;
if (check_add_overflow(addend1, addend2, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* size_sub() - Calculate size_t subtraction with saturation at SIZE_MAX
*
* @minuend: value to subtract from
* @subtrahend: value to subtract from @minuend
*
* Returns: calculate @minuend - @subtrahend, both promoted to size_t,
* with any overflow causing the return value to be SIZE_MAX. For
* composition with the size_add() and size_mul() helpers, neither
* argument may be SIZE_MAX (or the result with be forced to SIZE_MAX).
* The lvalue must be size_t to avoid implicit type conversion.
*/
static inline size_t __must_check size_sub(size_t minuend, size_t subtrahend)
{
size_t bytes;
if (minuend == SIZE_MAX || subtrahend == SIZE_MAX ||
check_sub_overflow(minuend, subtrahend, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* array_size() - Calculate size of 2-dimensional array.
*
@@ -251,15 +314,7 @@
* Returns: number of bytes needed to represent the array or SIZE_MAX on
* overflow.
*/
static inline __must_check size_t array_size(size_t a, size_t b)
{
size_t bytes;
if (check_mul_overflow(a, b, &bytes))
return SIZE_MAX;
return bytes;
}
#define array_size(a, b) size_mul(a, b)
/**
* array3_size() - Calculate size of 3-dimensional array.
@@ -273,45 +328,7 @@ static inline __must_check size_t array_size(size_t a, size_t b)
* Returns: number of bytes needed to represent the array or SIZE_MAX on
* overflow.
*/
static inline __must_check size_t array3_size(size_t a, size_t b, size_t c)
{
size_t bytes;
if (check_mul_overflow(a, b, &bytes))
return SIZE_MAX;
if (check_mul_overflow(bytes, c, &bytes))
return SIZE_MAX;
return bytes;
}
static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
{
size_t bytes;
if (check_mul_overflow(n, size, &bytes))
return SIZE_MAX;
if (check_add_overflow(bytes, c, &bytes))
return SIZE_MAX;
return bytes;
}
/**
* struct_size() - Calculate size of structure with trailing array.
* @p: Pointer to the structure.
* @member: Name of the array member.
* @count: Number of elements in the array.
*
* Calculates size of memory needed for structure @p followed by an
* array of @count number of @member elements.
*
* Return: number of bytes needed or SIZE_MAX on overflow.
*/
#define struct_size(p, member, count) \
__ab_c_size(count, \
sizeof(*(p)->member) + __must_be_array((p)->member),\
sizeof(*(p)))
#define array3_size(a, b, c) size_mul(size_mul(a, b), c)
/**
* flex_array_size() - Calculate size of a flexible array member
@@ -327,7 +344,22 @@ static inline __must_check size_t __ab_c_size(size_t n, size_t size, size_t c)
* Return: number of bytes needed or SIZE_MAX on overflow.
*/
#define flex_array_size(p, member, count) \
array_size(count, \
sizeof(*(p)->member) + __must_be_array((p)->member))
size_mul(count, \
sizeof(*(p)->member) + __must_be_array((p)->member))
/**
* struct_size() - Calculate size of structure with trailing flexible array.
*
* @p: Pointer to the structure.
* @member: Name of the array member.
* @count: Number of elements in the array.
*
* Calculates size of memory needed for structure @p followed by an
* array of @count number of @member elements.
*
* Return: number of bytes needed or SIZE_MAX on overflow.
*/
#define struct_size(p, member, count) \
size_add(sizeof(*(p)), flex_array_size(p, member, count))
#endif /* __LINUX_OVERFLOW_H */

98
lib/test_overflow.c
View File

@@ -588,12 +588,110 @@ static int __init test_overflow_allocation(void)
return err;
}
struct __test_flex_array {
unsigned long flags;
size_t count;
unsigned long data[];
};
static int __init test_overflow_size_helpers(void)
{
struct __test_flex_array *obj;
int count = 0;
int err = 0;
int var;
#define check_one_size_helper(expected, func, args...) ({ \
bool __failure = false; \
size_t _r; \
\
_r = func(args); \
if (_r != (expected)) { \
pr_warn("expected " #func "(" #args ") " \
"to return %zu but got %zu instead\n", \
(size_t)(expected), _r); \
__failure = true; \
} \
count++; \
__failure; \
})
var = 4;
err |= check_one_size_helper(20, size_mul, var++, 5);
err |= check_one_size_helper(20, size_mul, 4, var++);
err |= check_one_size_helper(0, size_mul, 0, 3);
err |= check_one_size_helper(0, size_mul, 3, 0);
err |= check_one_size_helper(6, size_mul, 2, 3);
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, 1);
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, 3);
err |= check_one_size_helper(SIZE_MAX, size_mul, SIZE_MAX, -3);
var = 4;
err |= check_one_size_helper(9, size_add, var++, 5);
err |= check_one_size_helper(9, size_add, 4, var++);
err |= check_one_size_helper(9, size_add, 9, 0);
err |= check_one_size_helper(9, size_add, 0, 9);
err |= check_one_size_helper(5, size_add, 2, 3);
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, 1);
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, 3);
err |= check_one_size_helper(SIZE_MAX, size_add, SIZE_MAX, -3);
var = 4;
err |= check_one_size_helper(1, size_sub, var--, 3);
err |= check_one_size_helper(1, size_sub, 4, var--);
err |= check_one_size_helper(1, size_sub, 3, 2);
err |= check_one_size_helper(9, size_sub, 9, 0);
err |= check_one_size_helper(SIZE_MAX, size_sub, 9, -3);
err |= check_one_size_helper(SIZE_MAX, size_sub, 0, 9);
err |= check_one_size_helper(SIZE_MAX, size_sub, 2, 3);
err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX, 0);
err |= check_one_size_helper(SIZE_MAX, size_sub, SIZE_MAX, 10);
err |= check_one_size_helper(SIZE_MAX, size_sub, 0, SIZE_MAX);
err |= check_one_size_helper(SIZE_MAX, size_sub, 14, SIZE_MAX);
err |= check_one_size_helper(SIZE_MAX - 2, size_sub, SIZE_MAX - 1, 1);
err |= check_one_size_helper(SIZE_MAX - 4, size_sub, SIZE_MAX - 1, 3);
err |= check_one_size_helper(1, size_sub, SIZE_MAX - 1, -3);
var = 4;
err |= check_one_size_helper(4 * sizeof(*obj->data),
flex_array_size, obj, data, var++);
err |= check_one_size_helper(5 * sizeof(*obj->data),
flex_array_size, obj, data, var++);
err |= check_one_size_helper(0, flex_array_size, obj, data, 0);
err |= check_one_size_helper(sizeof(*obj->data),
flex_array_size, obj, data, 1);
err |= check_one_size_helper(7 * sizeof(*obj->data),
flex_array_size, obj, data, 7);
err |= check_one_size_helper(SIZE_MAX,
flex_array_size, obj, data, -1);
err |= check_one_size_helper(SIZE_MAX,
flex_array_size, obj, data, SIZE_MAX - 4);
var = 4;
err |= check_one_size_helper(sizeof(*obj) + (4 * sizeof(*obj->data)),
struct_size, obj, data, var++);
err |= check_one_size_helper(sizeof(*obj) + (5 * sizeof(*obj->data)),
struct_size, obj, data, var++);
err |= check_one_size_helper(sizeof(*obj), struct_size, obj, data, 0);
err |= check_one_size_helper(sizeof(*obj) + sizeof(*obj->data),
struct_size, obj, data, 1);
err |= check_one_size_helper(SIZE_MAX,
struct_size, obj, data, -3);
err |= check_one_size_helper(SIZE_MAX,
struct_size, obj, data, SIZE_MAX - 3);
pr_info("%d overflow size helper tests finished\n", count);
return err;
}
static int __init test_module_init(void)
{
int err = 0;
err |= test_overflow_calculation();
err |= test_overflow_shift();
err |= test_overflow_size_helpers();
err |= test_overflow_allocation();
if (err) {