From patchwork Thu Apr 6 21:18:23 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 9668455 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7CA6F602B3 for ; Thu, 6 Apr 2017 21:20:28 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id B5BF3285A1 for ; Thu, 6 Apr 2017 21:20:24 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id A91FD285E7; Thu, 6 Apr 2017 21:20:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.1 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_MED,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id D4945285A1 for ; Thu, 6 Apr 2017 21:20:23 +0000 (UTC) Received: (qmail 31748 invoked by uid 550); 6 Apr 2017 21:19:33 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 29697 invoked from network); 6 Apr 2017 21:19:18 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=Jgrw+Euc1/ISprLp4uzt0Zjtdt4vXwQynsVfGMN72mk=; b=QLfOBdAQPRvMSFjqeONQn+eyE3ny6cfnuzELQKMl5YW5M/22Jr7fBl9ClELb65SFTk USUnE3ywVDw5nD5cPFuXf+AJox/fK/kLU8tocIeu9MkYHTScxaC9q58f+m4GGAfj2Faz 1Zj/3VU0iW9mXG4sETn2eK/H4wSq8LZrHzFD4= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=Jgrw+Euc1/ISprLp4uzt0Zjtdt4vXwQynsVfGMN72mk=; b=cMa1OpuqL1k9hSe3EY4gqQ3Nk0RxXMXs4gAYA6v+WJyjQOSvB1/gwdCdil1PpCHgGF Llz26mVLq5VJvZbEwj+6LQR8cJqW/eTg6rIrfBcBvkJU3/lCGrfzLHrPRNQ+Je0YB0pl 2rcef2Fp36Y041Yi4xFoG9WEn8uvN05zP5rUVEQPhBmrXmy1k8MBKRSVKIqyFHuuekU1 AY1gTZo3oiikbTOQk5oRkt2Qho5kgi+Bkn9OLojQlhVzZmuMi8wsfTkWsUfTT+YAfwZH bfumtMK+8hH9sHgT0PaTcfx8TUOwD/Worz6BSahKBC2YZc2hd0RDU4gUrWLuD+bEHp63 +ykw== X-Gm-Message-State: AFeK/H1uPnxWt4L6UyxgaYjtbOEx8CV21J+MCPuzyTcqm610mSiqyxXanQgDRB2pA9AClask X-Received: by 10.84.202.12 with SMTP id w12mr45147168pld.55.1491513546651; Thu, 06 Apr 2017 14:19:06 -0700 (PDT) From: Kees Cook To: kernel-hardening@lists.openwall.com Cc: Kees Cook , Michael Leibowitz Date: Thu, 6 Apr 2017 14:18:23 -0700 Message-Id: <1491513513-84351-9-git-send-email-keescook@chromium.org> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1491513513-84351-1-git-send-email-keescook@chromium.org> References: <1491513513-84351-1-git-send-email-keescook@chromium.org> MIME-Version: 1.0 Subject: [kernel-hardening] [PATCH 08/18] randstruct: Whitelist UNIXCB cast X-Virus-Scanned: ClamAV using ClamSMTP This is another false positive in bad cast detection: net/unix/af_unix.c: In function ‘unix_skb_scm_eq’: net/unix/af_unix.c:1621:31: note: found mismatched rhs struct pointer types: ‘struct unix_skb_parms’ and ‘char’ const struct unix_skb_parms *u = &UNIXCB(skb); ^ UNIXCB is: #define UNIXCB(skb) (*(struct unix_skb_parms *)&((skb)->cb)) And ->cb is: char cb[48] __aligned(8); This is a rather crazy cast, but appears to be safe in the face of randomization, so whitelist it in the plugin. Signed-off-by: Kees Cook --- scripts/gcc-plugins/randomize_layout_plugin.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/scripts/gcc-plugins/randomize_layout_plugin.c b/scripts/gcc-plugins/randomize_layout_plugin.c index 63c654a00249..a2d7e933c33f 100644 --- a/scripts/gcc-plugins/randomize_layout_plugin.c +++ b/scripts/gcc-plugins/randomize_layout_plugin.c @@ -773,6 +773,15 @@ static bool type_name_eq(gimple stmt, const_tree type_tree, const char *wanted_n case RECORD_TYPE: type_name = TYPE_NAME_POINTER(type_tree); break; + case INTEGER_TYPE: + if (TYPE_PRECISION(type_tree) == CHAR_TYPE_SIZE) + type_name = "char"; + else { + inform(gimple_location(stmt), "found non-char INTEGER_TYPE cast comparison: %qT\n", type_tree); + debug_tree(type_tree); + return false; + } + break; default: inform(gimple_location(stmt), "unhandled cast comparison: %qT\n", type_tree); debug_tree(type_tree); @@ -864,7 +873,13 @@ static unsigned int find_bad_casts_execute(void) #ifndef __DEBUG_PLUGIN if (lookup_attribute("randomize_performed", TYPE_ATTRIBUTES(ptr_lhs_type))) #endif - inform(gimple_location(stmt), "found mismatched rhs struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); + { + /* Whitelist unix_skb_parms via UNIXCB() */ + if (whitelisted_cast(stmt, ptr_lhs_type, ptr_rhs_type, "unix_skb_parms", "char")) + continue; + + inform(gimple_location(stmt), "found mismatched rhs struct pointer types: %qT and %qT\n", ptr_lhs_type, ptr_rhs_type); + } continue; }